# Chain of custody

URL: https://sellmydatatoai.net/glossary/chain-of-custody

Chain of custody is the documented record of who held a dataset, when, and why it changed hands, from collection to delivery.

Chain of custody is a process that tracks the movement of evidence or data through collection, safeguarding and analysis, recording who handled it, when and why. The definition comes from [NIST](https://csrc.nist.gov/glossary/term/chain_of_custody), which uses the term for digital forensic evidence in SP 800-72 and SP 800-101.

## How does chain of custody apply to training data?

In a data license, chain of custody shows that the dataset delivered is the dataset described, and that no one altered it on the way. A good record logs each export from the source system, the person who ran it, file hashes at each step, any de-identification run and the transfer to the buyer.

## How is it different from chain of title?

Chain of custody tracks the physical handling of the files. [Chain of title](https://sellmydatatoai.net/glossary/chain-of-title) tracks the legal ownership of the rights in them. Buyers check both: a dataset with clean title but no custody record may still have been edited or mixed with other data.

Record the hashes in the [data manifest](https://sellmydatatoai.net/glossary/data-manifest) so the buyer can verify delivery. Our guide to [building a data manifest](https://sellmydatatoai.net/guides/how-to-build-a-data-manifest) shows the fields.