The once-only principle is a public-service design rule: if the state already holds verified data about a person or business, another agency should not ask for it again. Instead, authorized systems should retrieve it from the authoritative source through controlled, auditable services.
In cyber security, this principle matters because it shifts risk from paper handling and duplicate databases to identity, authorization, logging, and API governance. Done well, it reduces data re-entry errors, stale records, and unnecessary data copies. Done poorly, it can concentrate sensitive information in a shared platform, where weak credentials, overbroad permissions, or poor purpose control can expose many services at once. Defenders use least privilege, strong service authentication, transaction logs, and monitoring to ensure each lookup is justified and recorded. In real-world digital government, the principle is a core safeguard for interoperability: it helps services exchange data efficiently without creating extra attack surface or uncontrolled replication.