26. The third standard

26. The third standard is that personal data shall be adequate, relevant, and limited to what is necessary for the purposes for which they are processed.