What is data provenance?
The short answer
Data provenance is the record of where data came from, how it was made and who handled it. The W3C defines it as information about the entities, activities and people involved. For owners, it covers rights: contracts, notices and consents. California requires AI developers to post training data sources.
Think of provenance as the paper trail for a dataset.
What does provenance record?
The W3C's PROV overview is a working group note. It treats provenance as information about the entities, activities and people involved in producing data (W3C). It is metadata, so it travels with the data or points to where the facts live.
An industry standard makes it concrete. The Data Provenance Standards, version 1.0.0, launched in Nov 2023. A coalition of large companies co-developed them.
They group metadata fields into source, provenance and use. Items include collection method, consent documentation location and usage license terms (D&TA).
Why do AI buyers care?
Rights and regulation, mostly. California's AB 2013 is in force.
It requires developers of generative AI for public use in California to post a high-level summary of their training data. The summary must cover these points (Crowell):
- The sources.
- Whether the data was purchased or licensed.
- Whether it contains personal information.
So a buyer has its own reasons to document where your records came from, and it will ask you. Expect questions about ownership, notices and consents.
Who markets provenance?
Protege, a data marketplace, tells data owners they can monetize their assets "while maintaining clear rights protections and provenance" (Protege). I'd treat that as marketing. The page does not publish a revenue split.
What does provenance look like for a company archive?
A short file per system, nothing fancy. It lists these facts:
- Which tool the records come from.
- What years they cover.
- Who created them.
- Which customer contracts and vendor terms touch them.
- What notice staff and customers received.
- Which categories you excluded.
Our readiness checklist lists the same inputs as seven lines. The rights check turns the contract and consent ones into questions. The risk map shows where gaps have caused objections.
We give no legal advice. Talk to a privacy or commercial lawyer in your state before you sign.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
