Playbook 3 — Data & Bias

Data Origin — Know Where It Came From

“Garbage in, garbage out” applies whether you’re training a model or just feeding one. The fact that data is available doesn’t mean you’re allowed to use it.

• We know whether the data is internally generated, purchased, public, or client-provided.
• If it’s third-party data, we’ve confirmed the license allows this specific use (commercial use is not automatically included).
• If it includes anyone’s personal data, we have a documented legal basis for using it (consent, contract, legitimate interest).

GDPR Minimum Viable Compliance

Consent, when that’s the basis

Must be explicit (actively given, not assumed), informed (the person knows what and why), revocable, and not reused for a new purpose without asking again.

Data minimization

Only collect what the AI use actually needs. If you can’t explain why a field is being fed to the model, don’t feed it.

When you need a Data Protection Impact Assessment (DPIA)

Required when the use involves new technology, large-scale data processing, or a meaningful effect on people’s rights — e.g. an AI hiring tool screening every applicant, not a one-off internal experiment. If in doubt, treat it as required; a short DPIA is cheap insurance.

Bias Sanity-Check — For Hiring, Credit, Pricing, or Performance Use Cases

You don’t need a data science team to catch the obvious cases. This is a non-technical version of the subgroup testing the deck describes.

• We’ve listed which groups the decision could affect differently (gender, age, location, tenure, etc.).
• We’ve compared the outcome rate across those groups on a sample of past or test decisions (e.g. approval rate by group).
• A gap of roughly 20 points or more between groups (e.g. 80% vs. 50% approval) is treated as a signal to investigate, not ignore.
• We’ve checked whether any input variable is a proxy for a protected characteristic (postal code can proxy for socioeconomic status or ethnicity; a name can proxy for gender or origin).
• Someone outside the team that built or bought the tool has reviewed this check.

When to Bring in Outside Help

• The use case is High tier (Playbook 1) and touches hiring, credit, or another regulated decision.
• The bias check above surfaces a gap you can’t explain.
• You’re not sure whether a DPIA is legally required — a short call with a data-protection lawyer is worth it before, not after, launch.
• You’re processing health, biometric, or financial data at any meaningful volume.

Next Steps

Document the answers to this playbook’s checklists in the AI Project Sheet (Playbook 6) — this is the record that protects you if a decision is ever questioned. If the bias check flags a real gap, pause deployment and go back to Playbook 1’s risk tier before proceeding.