Data minimisation

The cheapest and most reliable way to protect data is not to have it.

Data you never collected cannot leak, cannot be subpoenaed, cannot be stolen and costs nothing to look after. Every field collected "in case it is useful later" is a small permanent liability, and organisations accumulate them without ever deciding to. It is also the control that requires no technology, no budget and no ongoing effort, which is probably why it is proposed least often in a field that likes buying things.