Determine the lawfulness basis for using data in model training
Draft
Determine the lawfulness basis for using data in model training
Layer 4. Control REGCompliance and regulatory
Allocation
| L4-REG-03 | |
|---|---|
| Decides | DPO |
| Consulted | General Counsel and Data Steward |
| Executes | Data Steward |
| Evidence | Lawfulness determination, retained with the training data manifest |
In plain terms
Decide on what legal basis this data may train this model. Ambiguity is itself the finding, and a determination that resolves it is the evidence.
What is being judged
Whether a basis exists, and whether it covers this purpose. Data lawfully collected for service delivery is not automatically lawful for model training, and the gap between the two is where most of these determinations actually sit.
Four things to establish. The basis itself. Whether the purpose the data was collected for extends to training. Whether the data subject would reasonably expect it. What happens to the basis when the model is reused, since the basis travels with derived features and does not renew.
A determination that says the position is unclear is a valid output. It is more useful than a confident answer, because it produces a decision about whether to proceed rather than an assumption that the question was settled.
What this decision does not cover
It does not sign off the impact assessment, which is L4-REG-04. It does not approve access to the data, which is L3-06.
When it fires
On event. Before a training run using personal data. On extension to a new data source. On reuse of a feature set under L3-12. On a model purpose extension under L4-AUT-04.
On cycle. None.
What you need before deciding
The training data manifest. The original collection purpose and notice given. The data classification. Whether special category data is present. Which derived features already carry a basis from an earlier determination.
How this goes wrong
Basis inherited from collection: the data was lawfully collected, therefore training is lawful, which does not follow. Consent drift through features: a feature set built under one basis is reused under another, quietly, which is why L3-12 exists and why this determination should be checked at reuse. Determination without a manifest: a basis stated for data nobody enumerated.
Related decisions
Downstream L3-12 feature reuse, L4-AUT-04 model reuse, L4-REG-04 impact assessment.
Upstream L3-03 data domain fitness.
Instrument references
GDPR Articles 5, 6 and 9. ISO/IEC 42001 Annex A data controls. EU AI Act Article 10 data governance addresses quality and representativeness rather than lawfulness.
Correction
The maintainer answers corrections. There is no service level. Responses are best-effort and opportunistic within a reasonable time: a correction raised on a Monday is answered that week or sooner.