Data Life Cycle Checklist: Cloud Computing and Cloud Marketplace Toolkit Project

Much has been written about records management and the life cycle of records. Data have a similar life cycle. At each point in the data life cycle, an organization needs to consider its rights in the data relative to the rights and interests of third parties, as well as steps it should take to secure and control data so that they are not misappropriated or used intentionally or inadvertently in ways that are unauthorized or contrary to the organization’s policy or business interests.
This checklist describes the life cycle in five segments: getting data, storing data, using and sharing data, processing data—creating new data, and purging data. Specific life cycles for individual datasets vary. An organization should take care when combining datasets to account for the life cycle of the constituent datasets.
Throughout the data life cycle, the organization needs to consider third‑party interests that may affect data handling and controls placed on datasets to manage appropriate use. Third parties with interests in data may include one or more persons, such as data subjects, data licensors, and regulatory authorities.
Where U.S. laws control, attempting to frame data rights with principles of “ownership” is usually a distraction. The landscape for claims of data ownership could change, however, with developments in privacy law that attach property rights to personal information and developments in intellectual property law that extend protection to the outputs of emerging data‑driven technologies.
Getting Data
The manner in which data are acquired often sets the foundation for handling data throughout their life cycle. Interests of third parties may be intertwined in a single dataset. For example, individual‑level data about prospective customers licensed from