Control A.7.3: Acquisition of data
Determine and document the details of how the data used in AI systems are acquired and selected.
What control A.7.3 asks
Determine and document the details of how the data used in AI systems are acquired and selected.
Why it matters for privacy
Acquisition is where a lawful basis, a consent record and a contract term are either present or missing. It is very hard to repair later.
Where the draft lands: where the data came from. Privacy protection depends on a lawful source. The abstract treats the risk; the acquisition record is how the organization shows it controlled it.
Basis for A.7.3: the ISO page 56582 and the ISO/IEC 42001:2023 control record. The overlay is our reading of the published abstract and the stage record, not the draft text. Treating the risk: data and third parties.
Evidence for control A.7.3
This is the evidence an auditor or a privacy reviewer asks to see. For control A.7.3 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Data acquisition Data acquisition records: categories and quantity needed, sources (internal, purchased, shared, open, synthetic), source characteristics, data subject demographics and known biases, prior handling, data rights (PII, copyright), metadata and provenance
Where control A.7.3 commonly fails
- Data rights such as copyright or consent not recorded
- Synthetic or purchased data not distinguished
What to do about control A.7.3 before the draft lands
For each dataset, record the source, the basis, the permissions, the contract and the date. Refuse a dataset whose provenance cannot be shown.
The requirement for control A.7.3 is ISO/IEC 42001:2023, and a certificate is issued against that standard or ISO/IEC 27701. The privacy work extends the control to personal data in an AI system; it is not a new system and not a certification.
Read across from control A.7.3
- Control A.7.2, Data for development and enhancement of AI system
- Control A.7.4, Quality of data for AI systems
- Control A.7.5, Data provenance
- Control A.7.6, Data preparation
← Control A.7.2 | Control A.7.4 →
Open the full index. The public record behind control A.7.3 shows the scope and the lifecycle.
Source for control A.7.3: ISO/IEC 42001:2023, Annex A, retrieved 22 October 2026, at the standards library. The overlay rests on the public 27091 record. Every source.