Control A.7.6: Data preparation
Define and document the criteria for choosing data preparation methods and the preparation methods to be used.
What control A.7.6 asks
Define and document the criteria for choosing data preparation methods and the preparation methods to be used.
Why it matters for privacy
Preparation is where identifiers are removed or missed, where records are joined and where a dataset becomes more identifying than its sources.
Where the draft lands: preparation can create the risk. Joining two lawful datasets can produce an unlawful one. The abstract's risk identification has to reach the preparation step.
Basis for A.7.6: the ISO page 56582 and the ISO/IEC 42001:2023 control record. The overlay is our reading of the published abstract and the stage record, not the draft text. Treating the risk: data and third parties.
Evidence for control A.7.6
This is the evidence an auditor or a privacy reviewer asks to see. For control A.7.6 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Data preparation Documented criteria for selecting preparation methods
- Data preparation Record of methods and transforms applied per AI task (exploration, cleaning, imputation, normalization, scaling, labelling, encoding)
Where control A.7.6 commonly fails
- Preparation steps applied ad hoc and unrecorded
- Imputation choices not justified
What to do about control A.7.6 before the draft lands
Document each preparation step and its privacy effect. Test re-identification risk after joining, and record the decision on pseudonymisation and aggregation.
The requirement for control A.7.6 is ISO/IEC 42001:2023, and a certificate is issued against that standard or ISO/IEC 27701. The privacy work extends the control to personal data in an AI system; it is not a new system and not a certification.
Read across from control A.7.6
- Control A.7.2, Data for development and enhancement of AI system
- Control A.7.3, Acquisition of data
- Control A.7.4, Quality of data for AI systems
- Control A.7.5, Data provenance
← Control A.7.5 | Control A.8.2 →
Open the full index. The public record behind control A.7.6 shows the scope and the lifecycle.
Read control A.7.6 against ISO/IEC 42001:2023, Annex A, at the standards library. The overlay is ours, from the public record; nothing here is the draft text. Every source.