Entrusting data to an annotation provider means circulating it among dozens of people, across as many workstations, in a country that is sometimes far away. What that circulation requires is badly described by a certification logo displayed on a home page.
This article sets out those requirements. It extends the article on quality assurance.
What the circulation of data exposes
Five moments present a risk in a data labeling project. The initial transfer from the client’s own systems. The storage throughout the effective duration of the project. The display on the operators’ workstations. The return of the corpus once all the work is finished. And the destruction of the copies remaining at the provider’s. One important practical consequence follows. The last moment is the least well controlled, a copy forgotten on a workstation or in a backup sufficing to empty every preceding precaution of its reach.What the standard really demands
Five requirements structure a management system applied to data labeling. A formal analysis of the risks weighing on the information handled. Measures chosen in direct response to those identified risks. A documentation of the policies as well as the procedures applied. Internal audits verifying that those procedures are followed. And a periodic review bearing on the whole arrangement. One important observation follows for a data labeling project. The standard imposes an approach rather than a list of measures, which explains why two certified organisations can present very different levels of protection depending on the risks they identified.What the workstation imposes
Five measures frame the environment of data labeling operators. A named access strictly restricted to the people assigned to the project. A complete ban on removable media on the workstations concerned. A blocking of external storage as well as messaging services. A prevention of screen capture as well as of local copying. And a wholly dedicated room where sensitivity requires it. One practical consequence follows. The fourth measure is always circumvented by a personal phone, which explains why the most sensitive projects impose a room without personal devices rather than a plain software lock.What the certification scope covers
Five elements define a certificate’s real extent. The physical sites the audit genuinely and effectively covered. The activities included as well as those left outside the scope. The information systems that were genuinely examined. The date of the last audit as well as that of the next. And the certifying body having effectively conducted the evaluation. One important practical consequence follows for a data labeling project. The second element deserves reading before all the others, a certificate possibly covering a company’s head office without including the site where the work will actually be produced, which makes reading the scope more instructive than the presence of the logo.What traceability must cover
Five events deserve systematic recording. Every access to a batch of data, with its author as well as its time. Every export or else download made from the platform. Every modification made to the operators’ access rights. Every access attempt finally refused by the system. And every deletion operation conducted at the end of the project. One observation follows. The second event constitutes the most useful control point, an unusual export being spotted immediately in a log whereas an ordinary consultation says nothing.What committing people presupposes
Five arrangements frame the operators themselves. A confidentiality undertaking signed individually. An awareness briefing given before any access to the data. An identity check conducted at recruitment. An immediate withdrawal of access as soon as a person leaves. And a regular reminder of the rules throughout the project. One important practical consequence follows for a data labeling project. The fourth arrangement is neglected more often than the others, an access left open after a departure constituting the most common breach and the simplest to avoid.What subcontracting changes here
Five points deserve verifying when one provider employs another. The very existence of subcontracting on the project concerned. The level of protection genuinely applied at that second party. The passing on of confidentiality undertakings all the way down. The effective geographical location of the subcontracted work. And the right to audit that second party should it become necessary. One important observation follows for a data labeling project. The first point is rarely discovered spontaneously, a client assuming they work with the organisation they chose while part of the corpus circulates elsewhere, which justifies asking the question explicitly rather than waiting for it to be raised.What the regulation adds
Five constraints come from the law rather than from the standard. A legal basis clearly justifying the processing of personal data. A limitation of the processing to what the purpose alone requires. A strict framing of transfers to a third country. A retention period clearly defined and then respected. And an information of the people concerned where applicable. One important practical consequence follows for a data labeling project. The third constraint sometimes settles matters with no discussion possible, no technical measure making lawful a transfer the law forbids, which places that check before any evaluation of the security arrangement.What anonymisation permits and does not
Five observations frame this practice. It sharply reduces the risk without always eliminating it. It sometimes degrades the data to the point of making it useless. It demands preliminary work that itself carries a cost. It leaves perfectly identifying contextual elements in place. And it never dispenses with the other protective measures. One important observation follows for a data labeling project. The fourth observation often surprises, a blurred face leaving a silhouette, a setting or a plate perfectly recognisable, which makes partial anonymisation far less protective than it gives the impression of being.Three errors proper to security
Three data labeling defects belong to the protective arrangement. A certificate accepted without its scope ever having been read. A destruction promised contractually and yet never attested. And a subcontracting discovered well after the data was transmitted. Those three defects are not visible during the project, they reveal themselves when an incident occurs or an auditor looks for them, and their common point is to bear on what nobody took the time to verify.What the client must specify here
Five pieces of information come from the client rather than from the provider. The exact nature of the data transmitted as well as its sensitivity. The regulatory constraints weighing precisely on its processing. The period for which the provider may keep it. The countries towards which a transfer remains effectively authorised. And the level of attestation expected at the end of the project. One important observation follows for a data labeling project. The second piece is rarely passed on and is missed by everyone, a provider unaware of the applicable framework being unable to propose a suitable arrangement, which leaves each party assuming the other verified that point.What an incident requires providing for
Five points deserve writing down before an incident occurs. The precise delay within which the client must be informed. The named person to whom the information must be addressed. The precise elements the provider undertakes to supply. The protective measures to take immediately on site. And the exact division of regulatory notification obligations. One important practical consequence follows for a data labeling project. The first point decides all the rest, a regulation sometimes imposing notification within tens of hours while a provider discovers the incident several days later, which makes the contractual delay more determining than the quality of the response given.What an on-site audit permits seeing
Five observations follow from no document at all. The real configuration of the workstations used. The presence or absence of personal devices in the room. The way access rights are managed day to day. The knowledge operators genuinely have of the applicable rules. And the gap between the written procedure and the practice observed. One important observation follows for a data labeling project. The last point alone justifies the trip, a perfectly drafted procedure being able to coexist with a practice that departs from it without anyone having meant to deceive, which makes one visit more instructive than reading ten documents.What this chapter shares with the previous ones
Three findings recur from the start of this course. What is not written cannot be verified and therefore does not exist. A reassuring display says nothing about the arrangement it covers. And the most expensive defect stays the one nobody looks for. One important practical consequence follows for a data labeling project. The second finding takes its clearest form here, a certification logo playing exactly the role a global rate played in the preceding chapter, which calls for the same critical reading in both cases.What this subject has that is particular
Four traits distinguish this question from the course’s others. It is judged on an incident that may never happen at all. It is very badly verified from outside the organisation. It engages a responsibility the contract does not entirely transfer. And it is far too often reduced to a logo in a brochure. One important observation follows for a data labeling project. The third trait deserves to be known by both parties, a client staying responsible for the personal data they entrust even where a provider commits the fault, which makes prior verification less optional than it looks.What the cost of security covers
Five items compose this expenditure on a data labeling project. The storage infrastructure as well as the controlled access. The licences of the tools ensuring workstation partitioning. The time spent managing rights and departures. Internal audits as well as preparing for external ones. And fitting out the spaces where the project requires it. One important observation follows for a data labeling project. The third item is systematically underestimated, the daily management of access occupying a significant share of a manager whose salary appears elsewhere, which makes that expense invisible in comparisons and very real in practice.What certification brings regardless
Five benefits accompany a seriously conducted approach. A risk analysis nobody would ever have conducted otherwise. Written procedures rather than mere habits passed on orally. A periodic outside look at practices that have become invisible. A response already prepared rather than improvised on the day of an incident. And a common language with all the clients who require it. One important practical consequence follows for a data labeling project. The third benefit alone justifies the exercise, an organisation ceasing to see its own gaps within a few months, which makes the external audit the only mechanism able to reveal them before an incident does.What the end of the project must produce
Five operations properly close a data labeling project. The return of the corpus in the contractually agreed format. The deletion of the data present on the workstations. The deletion of the copies still held in the backups. The withdrawal of all the access granted to operators. And the handing over of a dated attestation covering every operation. One important observation follows for a data labeling project. The third operation is almost systematically neglected, a backup keeping data long after its apparent deletion, which makes the destruction procedure incomplete as long as it ignores the copies nobody sees.What the provider brings here
Four contributions distinguish a serious data labeling arrangement. A certification scope communicated without being asked for. A strictly named list of the people accessing the corpus. A destruction attestation dated and handed over at the project’s end. And an explicit declaration of any subcontracting envisaged. One important practical consequence follows. The third contribution is neglected almost everywhere and gets noticed at once, a dated attestation closing the project as cleanly as the delivery did, which reassures a client far more than a contractual clause nobody ever verified.What this chapter presupposes of the provider
Five practices distinguish real security from displayed security. Communicating the certification scope without waiting to be asked. Announcing any subcontracting rather than letting it be discovered. Handing over a destruction attestation at the project’s end. Accepting a visit to the site where the work will really be produced. And refusing a project whose constraints cannot be met. One important practical consequence follows. The last practice costs a deal and protects both parties, a provider accepting data they cannot properly protect exposing their client to a risk no contractual clause will compensate, which makes refusal preferable to an untenable commitment.Approaching security requirements
Five questions scope the security of a data labeling project. Can the data leave. Some of it cannot. Who accesses the data. The list must be named. What is traced. Exports count more than reads. How is destruction done. It is documented or it does not exist. And does the certification cover this scope. Often not. Those five answers determine the real level of protection. Asking them before transmitting avoids discovering a gap afterwards.The question that frames the arrangement
One question determines the level of protection needed in data labeling. Would a leak of this data harm a person or the company. Harm to the company, an industrial secret or a competitive advantage, is handled by contractual and technical measures proportionate to the economic damage. Harm to a person, a medical record or a recognisable identity, engages a responsibility neither the contract nor compensation repairs. That question belongs to the nature of the harm and not to its probability, it is asked before any transfer, and it separates two levels of requirement with no common measure.Three decisions before transmitting
Three decisions commit the security of a data labeling project. Verifying the exact scope covered by the certification displayed. Writing the destruction procedure before the first transfer even happens. And requiring the named list of the people accessing the data. Those three decisions cost a few hours, they precede any sending of data, and their absence leads to discovering a gap once the corpus is already circulating.Three checks on a provider
Three controls qualify a data labeling arrangement. The exact scope genuinely covered by the certification displayed. The existence of a written procedure for destroying the copies. And the presence or absence of subcontracting on the project. Those three controls are each asked in one question, they require no technical competence, and their absence indicates an arrangement of which the client knows only the façade.Three questions before transmitting
Three questions precede sending data to a provider. What exact scope does the certification displayed cover. What destruction procedure will apply at the project’s end. And will part of the work be entrusted to a third party. Those three questions are asked in a few minutes, they require no technical competence, and their absence leads to transmitting data on the strength of a logo nobody has examined.What this chapter teaches
One cross-cutting observation deserves closing this examination. A certificate attests to an approach, not to a level of protection. Three findings compose it. The standard imposes a method rather than a list of measures. Destroying the copies is the least well controlled of every stage. And an access left open after a departure is the most common breach. That finding extends the preceding chapters, verification bearing here on the arrangement rather than on its display.What this chapter leaves to the next
An arrangement protects data somebody still has to know how to describe. Three questions stay open in data labeling. What an instruction must hold to be applied everywhere in the same way. Why a concrete example transmits better than a long paragraph. And how to keep a reference alive throughout the project. Those three questions belong to writing instructions, which constitute the subject of the following chapter.Why the scope is worth volunteering
One point about how certification gets presented belongs at the close. Almost nobody displays the scope alongside the logo. Three reasons follow in data labeling. The logo is what buyers recognise and ask about. The scope is a paragraph nobody requests during a sales conversation. And a narrower scope invites questions a competitor will not face. One important practical consequence follows for a data labeling provider. Volunteering it regardless separates the two kinds of provider immediately, since a client who has been handed the scope unprompted knows what they are buying, and one who discovers a limitation during an audit will assume it was hidden on purpose whether or not it was.What both parties carry here
Four responsibilities stay shared whatever the contract says. The client chooses who receives their data. The provider protects it according to what was agreed. Both must know which regulation applies before the transfer. And neither can transfer the consequence of a breach entirely to the other. One important observation follows for a data labeling project. The last responsibility is the one most often misunderstood, a contractual clause allocating liability between the parties without changing what a regulator or an affected person may claim, which makes verification worth more than any indemnity provision.Common mistakes
These failures recur often enough that naming them is usually enough to avoid them.- Settling for a certification logo without reading the scope.
- Omitting the destruction procedure at the project’s end.
- Leaving access open after an operator’s departure.
- Neglecting the question of personal devices in the room.
- Tracing reads without tracing exports.
- Transmitting sensitive data before verifying the arrangement.
- Assuming a subcontractor applies the same rules.
- Confusing transfer encryption with protection during the work.
- Signing a collective undertaking rather than a named one.
- Discovering the regulatory constraints after the start.
