Data governance asks whether an organization may use data, whether the data are fit for the intended purpose, who can access them, how long they persist, and what happens when rights or upstream facts change. A model snapshot is not enough. Policy must cover collection, labeling, transformation, training, evaluation, retrieval, logging, feedback, sharing, deletion, and retirement. The governing record should connect every deployed model version to the data and processing decisions that shaped it.
Represent provenance as a directed lineage graph. A node may be a source, dataset version, transformation, annotation run, model, or evaluation; an edge records what operation produced the next artifact. For every source, store origin, acquisition time, permitted purpose, license or other authority, consent constraints where applicable, collection method, retention rule, sensitivity, and responsible owner. Content hashes and signed manifests can detect silent changes, but they prove integrity of the record, not that the underlying use is lawful or fair.
Fitness requires more than aggregate accuracy. Record missingness, duplication, label uncertainty, temporal coverage, source mixture, and subgroup representation. If error for group $g$ is $e_g$ and the reference error is $e_{\mathrm{ref}}$, inspect $$\Delta_g=e_g-e_{\mathrm{ref}}$$ with uncertainty intervals and sample counts. A small observed gap from a tiny subgroup is not strong reassurance. Compare training, validation, test, and deployment distributions, and investigate whether cleaning steps removed rare but policy-important cases.
When an analysis needs a formal privacy guarantee, differential privacy bounds how much one person's inclusion can change output probabilities. For adjacent datasets $D$ and $D'$ and any output set $S$, the mechanism $M$ satisfies $$(\epsilon,\delta)\text{-privacy if }\Pr[M(D)\in S]\le e^\epsilon\Pr[M(D')\in S]+\delta.$$ Smaller $\epsilon$ and $\delta$ generally mean stronger protection, but the adjacency definition, threat model, implementation, and released outputs determine what the numbers actually guarantee.
Privacy loss accumulates. Under a basic composition bound, releases with budgets $(\epsilon_i,\delta_i)$ have totals no greater than $$\epsilon_{\mathrm{tot}}=\sum_i\epsilon_i,\qquad \delta_{\mathrm{tot}}=\sum_i\delta_i.$$ Tighter accounting may apply, but every release must consume a governed budget. A privacy mechanism does not repair unauthorized collection, poor access control, insecure raw data, or unrepresentative samples. It is one control inside a wider system of minimization, purpose limitation, security, and accountability.
Operate a linked data and privacy ledger. Before use, require purpose approval, provenance review, quality tests, access rules, retention and deletion behavior, and a documented path for corrections. During training and evaluation, record dataset and code versions, transformations, privacy parameters, budget consumption, exceptions, and model outputs that may leak data. After deployment, monitor extraction and memorization tests, complaints, access logs, drift, and deletion requests. Diagnostics should reveal unknown sources, stale permissions, broken lineage edges, subgroup gaps, and privacy spending without an accountable owner.