Chain of custody
By Gareth HoyleLast updated How we research
Chain of custody is the documented record of who held a dataset, when, and why it changed hands, from collection to delivery.
Chain of custody is a process that tracks the movement of evidence or data through collection, safeguarding and analysis, recording who handled it, when and why. The definition comes from NIST, which uses the term for digital forensic evidence in SP 800-72 and SP 800-101.
How does chain of custody apply to training data?
In a data license, chain of custody shows that the dataset delivered is the dataset described, and that no one altered it on the way. A good record logs each export from the source system, the person who ran it, file hashes at each step, any de-identification run and the transfer to the buyer.
How is it different from chain of title?
Chain of custody tracks the physical handling of the files. Chain of title tracks the legal ownership of the rights in them. Buyers check both: a dataset with clean title but no custody record may still have been edited or mixed with other data.
Record the hashes in the data manifest so the buyer can verify delivery. Our guide to building a data manifest shows the fields.