What is Data Compliance?
Where the data came from, whether it may be used that way, and whether there is paper to prove it. That whole chain is compliance.
The rules differ by region: GDPR in the EU, state privacy laws in the US, CCPA in California. A cross-border delivery has to satisfy both ends.
Compliance is not paperwork added at the end. It has to be designed into collection from the start.
The parts of a compliance chain
Compliance answers three questions in order: where the data came from, whether the paperwork allows the intended use, and whether both can be proved. Each link has its own document. For recordings of real people the source link is a consent form; for licensed or web-derived material it is an agreement; the use link is the contract between buyer and supplier.
Different laws govern different links. Privacy law sets how personal data may be collected, kept and moved; in the EU that is GDPR, and in the US it is a patchwork of state laws including California's. Rights law governs the recording itself, through consent and licensing. A dataset can pass one layer and fail the other, which is why a single checkbox marked compliant proves nothing.
Cross-border delivery adds a third layer. Moving personal data between jurisdictions has its own rules, so a project with speakers in one country and a buyer in another has to satisfy both ends. That is why the compliance file is assembled per delivery: the same supplier's data can be clean for one buyer's jurisdiction and not for another's.
Where it shows up in a quote
Compliance work is priced in, even when it is not itemised. A project with a documented rights chain costs more than one without, and it is the version a buyer's legal review will actually accept. A cheaper quote often reflects a thinner chain rather than a more efficient supplier, and the gap surfaces during review, after the timeline has already slipped.
Ask what the compliance file contains before agreeing to a delivery: the consent or license documents, the speaker or source manifest, and the record of how the data was handled between collection and handover. For a cross-border project, ask which jurisdiction the paperwork is written to satisfy and what covers the transfer itself, because those two documents are usually held by different parties.
The last point is timing. Compliance has to be designed into collection, because almost none of it can be added afterwards. A batch recorded without forms cannot be repaired by better paperwork later, and anonymizing it afterwards does not create the rights that were missing. This is the part of a data project where the cheap option at the start is the expensive option at the end.
Related terms
-
PII
Personally Identifiable Information, anything that can identify a specific individual, directly or indirectly.
-
Consent
The speaker knows how their recording will be used, and has signed to say so.
-
GDPR
The EU data protection regulation, which places strict limits on how personal data may be collected and used.
Keep reading
-
Full glossary
Every term we explain, in one list.
-
How to buy training data
Where these terms actually show up, and which ones change a quote.
-
Help center
How a project runs, from specification to delivery.
Submit a sourcing request
Tell us the language, the hours, and what the data needs to look like. You will get a real number and a real timeline, not a range. If we cannot source it well, we will tell you that instead.
- Pilot batch before the full run, so problems surface early.
- Consent documentation delivered with the data.
- No medical or clinical data. No recorded telephone calls.
- You send the spec Language, hours, recording conditions, and the deadline.
- We reply within two business days A real number and a real timeline, not a range.
- You approve a pilot batch A small run first, so problems surface before the full order.
- Full run, then delivery with documents Audio, transcripts, and the consent record for every speaker.