What it asks for. Controllers must build data protection into the way processing is designed, using appropriate technical and organisational measures such as pseudonymisation and data minimisation. By default, only the personal data necessary for each specific purpose should be processed, which covers the amount collected, the extent of processing, the storage period and accessibility.
In practice. Privacy requirements are considered at the start of projects and changes, not added at the end. Concrete practice includes privacy checks in the development lifecycle, minimal default settings, limited data fields, role based access and automatic deletion. Evidence includes design reviews, privacy requirements in tickets or specifications, and configuration showing restrictive defaults.
Common gaps. Privacy review often happens too late to influence design. Defaults in products and internal tools frequently expose more data, to more people, for longer than the purpose requires.