Data provenance tracking for model inputs

Introduction

Data provenance tracking refers to the systematic recording of the origin, history, ownership, collection method, processing activities, and modifications of data used to train, validate, or operate artificial intelligence (AI) and machine-learning models. It helps organisations identify where model inputs originated, whether they were lawfully obtained, and how they were transformed before being used.

In biotechnology, data provenance is particularly important because AI models may process genetic sequences, clinical trial records, medical images, laboratory observations, and agricultural research datasets. If the source of such information is unclear, organisations may face problems relating to privacy, intellectual property, research reliability, and regulatory compliance.

For example, an AI model developed to identify genetic disorders may use information from hospitals, universities, public biological databases, and pharmaceutical research institutions. Provenance records help establish whether the information was obtained with appropriate authority and whether its use complies with applicable laws.

Legal framework in India

1. Digital Personal Data Protection Act, 2023

The DPDP Act, 2023 regulates the processing of digital personal data in India. It establishes obligations for Data Fiduciaries concerning lawful processing, security safeguards, and accountability.

Section 4 provides the framework for processing personal data for a lawful purpose. Section 8 establishes responsibilities concerning processing and security safeguards. Data provenance records can help organisations demonstrate how personal information was collected, processed, and shared.

However, the Act does not establish a separate statutory system specifically for AI model-input provenance. Its requirements must be considered alongside applicable commencement notifications and rules.

2. Information Technology Act, 2000

The Information Technology Act provides legal recognition to electronic records and addresses certain forms of unauthorised access and misuse of computer resources. Section 43 provides for compensation for specified unauthorised computer-related acts, while Section 66 addresses certain acts under Section 43 when committed dishonestly or fraudulently.

Provenance logs, access records, and digital audit trails may assist organisations in investigating unauthorised changes to model datasets.

3. Patents Act, 1970 and Copyright Act, 1957

Model inputs may include patented research material, copyrighted databases, scientific publications, and confidential datasets. The Patents Act regulates patent rights, while the Copyright Act protects qualifying original databases and other protected works.

Maintaining provenance records helps organisations identify licensing restrictions and determine whether datasets can legally be used for commercial model development.

International legal framework

The European Union's General Data Protection Regulation (GDPR) establishes principles of lawfulness, transparency, purpose limitation, data minimisation, and accountability under Article 5. Article 30 requires records of processing activities for organisations within its scope.

The EU Artificial Intelligence Act, 2024, also introduces requirements concerning data governance and data management for certain high-risk AI systems. Article 10 addresses training, validation, and testing data, including requirements concerning relevance, representativeness, and appropriate data governance.

These frameworks demonstrate the growing importance of documenting the origin and quality of AI model inputs.

Importance of provenance tracking

Data provenance tracking serves several important legal and technical purposes:

Source identification: Records whether information originated from hospitals, laboratories, public databases, or private research organisations.

Consent verification: Helps determine whether personal information was collected and used under an appropriate legal basis.

Copyright compliance: Identifies licensing conditions attached to datasets and research materials.

Data accuracy: Records corrections, transformations, and validation activities.

Security and accountability: Creates audit trails showing who accessed or modified datasets.

Regulatory compliance: Helps demonstrate adherence to applicable data protection and AI governance requirements.

In biotechnology, provenance records are especially useful when datasets contain genetic information or clinical trial results. They can also help researchers identify errors and reproduce scientific experiments.

Relevant case laws

There are limited reported judicial decisions directly concerning legal liability for AI model-input provenance. However, the following cases provide relevant principles.

1. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court of India recognised privacy as a fundamental right under Article 21. The judgment supports the need for transparency, lawful processing, and safeguards when personal information is collected and used in AI datasets. It is particularly relevant when model inputs contain identifiable medical or genetic information.

2. Anvar P.V. v. P.K. Basheer (2014)

The Supreme Court examined the admissibility of electronic records under Section 65B of the Indian Evidence Act, 1872. The judgment emphasised the importance of statutory requirements for proving electronic evidence. Its principles are relevant to maintaining reliable digital logs, dataset histories, and audit records, although electronic evidence law has since been updated under the Bharatiya Sakshya Adhiniyam, 2023.

3. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020)

The Supreme Court clarified the requirements for admitting electronic records under the former Section 65B framework. The decision demonstrates why organisations should maintain reliable records of data creation, storage, processing, and transfer.

4. Eastern Book Company v. D.B. Modak (2008)

The Supreme Court considered originality and copyright protection in legal databases. The judgment is relevant to determining whether databases used as AI model inputs contain copyright-protected original material. It does not establish ownership over every underlying fact or item of data.

These cases provide analogous legal principles rather than direct rulings on AI provenance tracking.

Challenges and compliance requirements

Organisations may face difficulties when datasets are collected from multiple jurisdictions, modified repeatedly, or combined with information from third-party providers. In some cases, the original source may be difficult to identify.

To reduce these risks, organisations should maintain:

Dataset source registers and collection dates.

Consent records or other applicable legal-basis documentation.

Licensing and data-sharing agreements.

Records of cleaning, transformation, and annotation.

Version histories and access logs.

Procedures for correcting or removing unlawfully obtained information.

Blockchain-based records and cryptographic hashes may support tamper-evident documentation, but they do not independently establish that the original data was lawful or accurate.

Conclusion

Data provenance tracking for model inputs is an important part of responsible AI governance. It enables organisations to identify data sources, verify permissions, monitor modifications, and demonstrate compliance with applicable legal requirements. In biotechnology, it is especially significant because AI systems frequently process sensitive genetic, medical, and clinical information. Indian privacy and electronic evidence principles, together with international data protection and AI governance frameworks, support the development of reliable provenance systems. Clear documentation, licensing verification, security controls, and regular audits can reduce legal risks and improve the reliability of AI-based research.