# What is data provenance?

> What is data provenance? The record of where data came from, how it was made and what rights attach. W3C and industry definitions, and why AI buyers ask for it.

By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-is-data-provenance  
Published: 2026-09-23  
Updated: 2026-10-14

## The short answer

Data provenance is the record of where data came from, how it was made and who handled it. The W3C defines it as information about the entities, activities and people involved. For owners, it covers rights: contracts, notices and consents. California requires AI developers to post training data sources.

Think of provenance as the paper trail for a dataset.

## What does provenance record?

The W3C's PROV overview is a working group note. It treats provenance as information about the entities, activities and people involved in producing data ([W3C](https://www.w3.org/TR/prov-overview/)). It is metadata, so it travels with the data or points to where the facts live.

An industry standard makes it concrete. The Data Provenance Standards, version 1.0.0, launched in Nov 2023. A coalition of large companies co-developed them.

They group metadata fields into source, provenance and use. Items include collection method, consent documentation location and usage license terms ([D&TA](https://www.dtaalliance.org/work/data-provenance-standards)).

## Why do AI buyers care?

Rights and regulation, mostly. California's AB 2013 is in force.

It requires developers of generative AI for public use in California to post a high-level summary of their training data. The summary must cover these points ([Crowell](https://www.crowell.com/en/insights/client-alerts/californias-ab-2013-requires-generative-ai-data-disclosure-by-january-1-2026)):

- The sources.
- Whether the data was purchased or licensed.
- Whether it contains personal information.

So a buyer has its own reasons to document where your records came from, and it will ask you. Expect questions about ownership, notices and consents.

## Who markets provenance?

[Protege](/buyers/protege), a data marketplace, tells data owners they can monetize their assets "while maintaining clear rights protections and provenance" ([Protege](https://withprotege.ai/)). I'd treat that as marketing. The page does not publish a revenue split.

## What does provenance look like for a company archive?

A short file per system, nothing fancy. It lists these facts:

- Which tool the records come from.
- What years they cover.
- Who created them.
- Which customer contracts and vendor terms touch them.
- What notice staff and customers received.
- Which categories you excluded.

Our [readiness checklist](/answers/data-readiness-checklist) lists the same inputs as seven lines. The [rights check](/rights-check) turns the contract and consent ones into questions. The [risk map](/risks) shows where gaps have caused objections.

We give no legal advice. Talk to a privacy or commercial lawyer in your state before you sign.

Figure: steps Source: who issued it -> Provenance: how it was made -> Use: rights and limits. A data provenance record covers three groups of facts: source, provenance and use.

_Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._

## Sources

- [W3C](https://www.w3.org/TR/prov-overview/)
- [D&TA](https://www.dtaalliance.org/work/data-provenance-standards)
- [Crowell](https://www.crowell.com/en/insights/client-alerts/californias-ab-2013-requires-generative-ai-data-disclosure-by-january-1-2026)
- [Protege](https://withprotege.ai/)

Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure)