Preparation guide

Dataset source and rights inventory: a preparation template

Trace original, supplied, and third-party material to source records. Track permission questions and exclusions without treating a checklist as legal clearance.

A source inventory connects each part of a dataset to the evidence a reviewer needs. It records what is known, what is missing, and which proposed uses need review; it does not certify that a dataset is licensable.

Choose a reviewable unit

Use a row for a source group, field family, document component, or asset batch with the same history. Split mixed material when the sources differ. For a product catalog, original descriptions and supplier images belong in separate rows even if they share a product ID. Give every row an internal source ID that can be traced into the proposed export.

Record where it came from and what happened to it

Capture the source name, collection or receipt date, collection method, date range, and internal custodian. Record transformations, annotations, merging, or filtering that changed the material. Keep links to the underlying evidence and note where a link is missing or a document is outdated. A transformation history helps explain provenance; it does not create new permissions by itself.

Connect evidence to the proposed use

List available agreements, contributor terms, supplier records, or other evidence using internal references. Record relevant questions raised by the proposed evaluation, retrieval, training, sharing, or distribution. Do not collapse “we hold a copy,” “we can access it,” and “we can grant this requested use” into one yes/no field. Ask qualified reviewers to assess the actual documents and context.

Keep privacy review distinct from content permission

If the collection may contain personal information, identify the affected categories and jurisdictions for a privacy reviewer. Removing direct identifiers is not a clearance certificate. The UK ICO’s generative-AI consultation response discusses lawful-basis questions for web-scraped personal data; its jurisdiction and context matter. Do not assume a commercial license alone resolves those questions elsewhere or for your collection.

Record decisions with owners and scope

Useful states include evidence missing, review pending, excluded, and reviewed for a specified proposal. Attach the reviewer, date, relevant release, and use considered. “Reviewed” should not imply unlimited approval for future versions or activities. Hold unresolved groups outside a proposed transfer until the responsible review process resolves them.

Reconcile the register with the delivery

Check that every included source ID appears in the register and that excluded IDs are absent from the export. Keep counts of missing links. When new material arrives, add a row and review the change rather than inheriting the previous release’s status. Share a high-level inventory summary for an initial conversation; keep private supporting documents in your own controlled records.

Fictional mixed-catalog example — no legal conclusion
Source groupEvidence availableNext action
Original descriptionsInternal authorship recordReview requested use and contributor history
Supplier imagesSupplier terms reference; scope unresolvedHold from sample pending review
Customer-derived examplesSource history incompleteExclude and escalate privacy questions

Source and review register

Edit this outline, then copy or download it. It stays in this page and is not submitted or saved by this tool. Keep confidential records and personal information out. Save your work before leaving or reloading.

You can select and copy the text manually. This is a preparation worksheet, not a legal agreement.

Sources and scope of this guidance

Sources checked October 19, 2026. The Data Provenance Initiative studies licensing and attribution problems in AI datasets. The ICO source addresses UK personal-data questions in a specific generative-AI context; it is not universal legal clearance. The inventory below is our own preparation aid.

Data Provenance Initiative: original dataset licensing researchUK ICO: lawful basis for web scraping to train generative AI