A model inherits the legal position of its training data. If you cannot say where the data came from, on what basis and under what terms, you cannot show that training was lawful, and you cannot answer the questions people and regulators will ask.
What to record for each dataset
| Item | Why |
|---|---|
| Source | First-party, licensed, public web, synthetic, or another controllerControllerDecides why and how personal data is processed. Carries most of the duties, and most of the penalties. |
| Collection date and method | Fixes which notices and terms applied |
| Lawful basis for training | Usually legitimate interestsLegitimate interestsA lawful basis needing a three-part test: a legitimate purpose, necessity, and a balance against the individual's interests and rights., with the assessment |
| Personal dataPersonal dataAny information relating to an identified or identifiable living person, including identifiers and combinations of data that single someone out. content | Including special category and children’s data |
| Terms and licences | Contractual or copyright limits on use |
| Processing applied | Filtering, deduplication, pseudonymisationPseudonymisationReplacing identifiers so data cannot be attributed to a person without separately held information. Pseudonymised data is still personal data, unlike truly anonymous data. |
| Retention | When the raw data will be deleted |
| Models trained on it | So rights requests and takedowns can be traced |
This is the record of processing applied to training data, and it should sit alongside it.
Scraped data
Publicly available personal data is still personal data. Web scraping for training needs a lawful basis and must respect people’s reasonable expectations. Filter out special category data and children’s data where you can, honour robots exclusions and opt-out signals, and keep the record above. The regulator’s action against Clearview AI for scraping images of UK people shows that collection from abroad does not put UK data out of reach.
Licensed data
A supplier’s assurance that data is “cleared for AI training” is a contractual promise, not a lawful basis. Ask what people were told, and on what basis it was collected, as for any bought data.
Synthetic data
Synthetic data reduces risk but does not end it. If the generator was trained on personal data and can reproduce it, the synthetic set can still contain personal data. Test for memorisation.
Keeping the trail usable
Provenance only helps if it is linked: dataset to model, model to deployment. That chain is what lets you respond to an erasure request, an objection or a regulator’s question about a specific person, and what lets you retire a model trained on data you should not have used.