Collection and creation conditions
The record covers the source, jurisdiction, reason, first use, collection method, consent, opt-out, timing, anonymization and relation to other data, plus proxies, synthetic generation, fitness and quality.
What clause 7.4.2.1 asks
The clause lists the conditions to think about, record and check for each data set. The list covers the source and how the data came from it, whether it came from another jurisdiction, the reason for choosing the source, the use it was first collected for, the collection method (crowd-sourced, synthesized, scraped, a fixed set or real time), whether supply was voluntary, whether an opt-out was available, whether the conditions can show human bias or behavioural patterns from discrimination or assumptions about groups, whether the data is free or purchased, when it was collected, whether it is anonymized or pseudonymized, and how it relates to other data sets. The clause then asks the team to identify possible proxies, examine a synthetic generator for the bias it can cause, assess fitness for purpose and run a data quality assessment.
Why it matters
This is the most concrete list in the standard, and it is also the one most often reduced to a vendor questionnaire. The conditions are not administrative. A data set collected under a compulsory process has a different meaning from one collected with an opt-out, even if the columns are identical. A synthetic data set inherits the assumptions of its generator. A proxy can reconstruct a protected attribute after the attribute was removed, which is why the proxy check comes after the decision log.
What good looks like
Turn the list into a data set record with one row per condition and a short answer. Where the answer is unknown, record the unknown and its effect. Run the proxy check against the protected attributes in the stakeholder set, not against a generic list. For synthetic data, record the generator, its version and what it cannot reproduce. Then run the fitness and quality checks and record the result, including a decision to use the data despite a limitation.
Evidence an assessor asks for
The assessor will choose a condition the team marked not applicable and ask why. A record that marks a whole block not applicable without a reason is a gap.
- Data set record One row per condition, with the answer, the source and the unknown
- Proxy analysis Possible proxies for each protected attribute, with the test used
- Synthetic record The generator, its version and the characteristics it cannot reproduce
- Fitness and quality The fitness for purpose decision and the data quality result
Where it commonly fails
- The record is a vendor security questionnaire
- Proxies are checked against a generic list rather than the protected attributes
- A synthetic data set is treated as neutral
What to do before publication
Complete the record before the exploration. The conditions explain the patterns the exploration will find.