Collect only the personal data you actually need for a specific purpose, keep it only as long as you need it, and redact it from anywhere it leaks unnecessarily.
GDPR Article 5 — Principles relating to processing of personal data
EDPB Guidelines 4/2019 on Article 25 Data Protection by Design and by Default