Seven Questions That Separate Fair Data Practice From Defensible Data Practice

Most enterprises can defend their data practices. Far fewer can explain them plainly. That difference — between defensible and genuinely fair — is where reputational risk, regulatory exposure, and lost customer trust now live.

The test below is deliberately fast. Hand it to your data governance lead, your privacy counsel, or your CIO and ask for answers on the spot. Hesitation, hedging, and delegation are themselves findings. A practice that cannot be described in a sentence is usually a practice that has not been thought through.

Question 1: Can you name, right now, every category of personal data you hold and why you hold it?

Strong answer: A current data inventory, organized by purpose, updated within the last two quarters. Common evasion: "Our data catalog project will answer that next year." What failure signals: No one owns the enterprise's data footprint. Until someone can enumerate it, no one can minimize, secure, or account for it.

Question 2: If a customer asked you to delete their data tomorrow, how long would it take, and could you prove it was done?

Strong answer: A documented workflow with a defined SLA, tested end to end, including backups and third-party processors. Common evasion: "We'd handle it through our standard process." What failure signals: Deletion is a promise your infrastructure cannot keep. In an era of state privacy laws with statutory response windows, that is a legal problem as much as an ethical one.

Question 3: On what basis do you collect data at the moment of collection — and would you say that basis out loud to your customer?

Strong answer: Purpose statements written in plain English, reviewed by someone outside the legal department, and actually shown at the point of capture. Common evasion: Pointing to a 6,000-word privacy policy nobody reads. What failure signals: Consent has become a legal instrument rather than a communication. Fair practice requires that people understand what they are agreeing to, not merely that they clicked.

Question 4: Which third parties touch your customer data, and are their practices contractually and operationally verified?

Strong answer: A maintained vendor register with data processing agreements, security attestations, and periodic audits — including for downstream subcontractors. Common evasion: "Our contracts cover that." What failure signals: Your data ethics program ends at your firewall. Regulators, plaintiffs, and journalists do not recognize that boundary, and neither should you.

Question 5: Has anyone ever said no to a data initiative here?

Strong answer: Documented examples of projects modified, narrowed, or cancelled on data ethics or minimization grounds, with leadership support. Common evasion: "We follow all applicable laws." What failure signals: Ethics that never override anything is not ethics; it is compliance with extra meetings. A mature program has teeth, and teeth leave marks.

Question 6: When your models make decisions about people, can you explain the data those decisions were trained on?

Strong answer: Documented training data lineage, including sources, collection terms, and known limitations, reviewed when models are materially updated. Common evasion: "The model is a black box." What failure signals: Provenance debt. You are making consequential decisions about individuals using data whose origins nobody can vouch for — an unexamined inheritance that compounds with every model generation.

Question 7: Who in your organization is personally accountable when data practice and data ethics diverge?

Strong answer: A named executive with authority to stop data uses, a defined escalation path, and evidence that the path has been used. Common evasion: "That's everyone's responsibility." What failure signals: Accountability diffused is accountability dissolved. Where no one can say stop, everyone will eventually say sorry.

Scoring Without Mercy

Six or seven confident answers suggests a program built on substance. Three or four indicates a compliance shell that will crack under pressure — from a breach, a subpoena, or a reporter. Fewer than three means your organization is one incident away from learning these questions the hard way, in front of an audience.

The value of this exercise is not the score. It is the five minutes of honesty it forces. Enterprises that can answer quickly have usually done the slow work already: inventories maintained, workflows tested, hard conversations had. Enterprises that cannot answer have usually assumed the work was being done somewhere, by someone. Fair data practice begins when that assumption ends.