Consent, Minimization, and Documentation

Available data is not automatically appropriate data

Data minimization means collecting and retaining only what a defined purpose genuinely requires. Consent means people have received an understandable choice where required; it is not a blanket permission for unrelated future uses. Access controls, retention limits, deletion procedures, and provenance all belong in an ML data design because training copies and experiment artifacts can multiply sensitive records.

A datasheet for datasets is a structured document explaining motivation, composition, collection, preprocessing, intended uses, known limitations, maintenance, and ethical considerations. It makes invisible assumptions reviewable and gives future practitioners evidence for deciding whether the dataset fits a new task.

Scenario: Customer chat transcripts are accessible to the engineering team, but were collected for support rather than model training and contain secrets users pasted during incidents. Technical access does not establish lawful purpose or safe handling.

purpose: classify internal synthetic training tickets
included: de-identified text, product, approved outcome label
excluded: credentials, names, payment data, raw production chats
retention: reviewed every 90 days; owner: ML platform team

Tip: Document who can stop deployment. Responsible governance needs named decision owners and escalation paths, not only principles in a slide deck.