Purpose limitation means that organizations must only collect and process personal data to accomplish specified, explicit and legitimate purposes and not process personal data beyond such purposes unless the further processing is compatible with the purposes for which the personal data was initially collected.