Data lineage: knowing where your training data came from

Three ways to see it

1. 1

   Data lineage is the documented chain of custody from the original source of every training and fine-tuning datum to the model's weights and through to the model's outputs. It answers four questions for every dataset used. Where did it come from originally? Under what licence or consent was it collected? What transformations were applied between collection and training? Who currently has the right to delete it? If any link in the chain is missing, the lineage is broken, and a regulator, a court, or a journalist can cut through the entire system at that weak point.

2. 2

   For a Pakistani context the lineage question becomes sharper because of three overlapping concerns. PII (personally identifiable information): names, CNICs, phone numbers, addresses, and now biometric data are governed by the draft Personal Data Protection Bill and de facto by NADRA's CNIC handling regulations. Sovereignty: the National AI Policy 2025 explicitly favours data residency in Pakistan for systems serving Pakistani citizens. Religious and cultural sensitivity: scraped Pakistani text often includes content that is appropriate to its original context but not to a public sector chatbot. Lineage is what lets you reason about all three before deployment.

3. 3

   Practical lineage record format, one row per dataset. Dataset name, version, size in tokens or rows. Source URL or vendor and acquisition date. Original collector and purpose of original collection. Licence or consent basis. Languages and approximate language distribution. PII review status: none, redacted, or pseudonymised. Geographic origin breakdown. Sensitive categories present (medical, financial, religious, political). Date last reviewed and reviewer. Date of planned deletion or refresh. This is one spreadsheet, ten columns, one row per dataset. Most teams will have between 3 and 30 rows. The discipline of filling the row is itself the audit.

The why-tree

Try this with Claude

Capstone challenge — three actions. (1) For one model your team uses or builds, attempt to fill the ten-column lineage row above; the gaps you find are your priority list. (2) For each dataset, identify which jurisdiction's law governs it and whether that creates conflict with Pakistani law. (3) Pick one dataset whose lineage is unclear and decide today whether to document, replace, or remove it within 30 days.