The Contact-Data Provenance Standard: Contract, Conditional, or Decline

This standard is for recruiting operations, revenue operations, and privacy reviewers who have to decide, before signing or renewing, whether a supplier of contact and profile data collected that data lawfully enough to use. It replaces trust with tests: a random sample of records traced to source, a registry check in every state that requires one, a live deletion test, and a clause-by-clause contract review. The output is a Contract, Conditional, or Decline verdict that two reviewers grading the same supplier would reach independently.

What does this standard decide, and who grades it?

This standard decides one thing: whether a contact-data supplier's evidence of lawful collection is strong enough to sign, strong enough to sign only under written conditions, or too weak to use. It applies to data bought for recruiting in the same way as data bought for sales prospecting, because the legal exposure follows the data, not the department that bought it.

Four terms come up throughout:

• Data broker: a business that sells or licenses personal data about people it has no direct relationship with.
• Provenance: where a specific record came from, under what terms, and on what date.
• Independent controller: a supplier that decides what to collect and sells its own database. Most contact-data suppliers are this kind.
• Processor: a supplier that handles your data on your instructions, for example by enriching a list you give it.

The three verdicts:

• Contract: every criterion passes on evidence you hold. Sign or renew.
• Conditional: the collection evidence passes, but a named gap remains, such as a deletion test still running or a clause the supplier has agreed to add. Sign only with each condition written down, given an owner, and dated.
• Decline: a collection criterion fails, or the supplier will not produce evidence. Do not buy.

The baseline comes from the UK regulator. The ICO's guidance says that before you use data broking services "you must undertake appropriate due diligence to satisfy yourself that the personal data being offered to you complies with the GDPR, DPA 2018 and if applicable the Privacy and Electronic Communications Regulations (PECR)." Its own worked example of failure is a case where "the data broker is not able to provide any evidence and the campaign group admits that the only due diligence they did was to have it written into the contract." The ICO has enforced this position too: it required Experian to stop processing supplier data where there was not enough evidence that it had been collected lawfully. US state law points the same way through its registries and deletion mandates, which are covered below.

Who actually grades suppliers

Most of these reviews will be done by ops staff, not lawyers, so this standard is written to work without counsel in the room.

That ratio undercounts title variants on both sides, but the direction is clear. The split between the US and the UK shows where the work lands:

Source: Refolk's index. Shares come from samples of 25 profiles per country, so treat them as directional.

The Data Protection Officer title is much more common in the UK sample. That fits the GDPR's mandated DPO role, though the index does not prove that is the cause. In practice, a UK buyer usually has a DPO who owns this review. A US buyer more often sends it to privacy counsel, and when counsel is busy, to an ops manager with a checklist. This standard is that checklist. Wherever a step says "privacy lead", read it as whoever in your organisation signs off on lawful basis.

What evidence does each criterion require?

Six criteria decide the verdict. Each one must be shown with evidence the buyer holds, not asserted by the supplier. The table states what each criterion proves and what it looks like when it misleads you.

The supplier's role decides which obligations apply

Classify the role before anything else, because it changes what the contract must say and who owes notice to the people in the data.

• Independent controller (sells its own database): Article 28 of the GDPR does not apply. You become a controller of the data you receive, and Article 14 puts the notice duty on you. Notice is due within a reasonable period after you obtain the data, and at the latest within one month. If you contact the person or pass the data on before then, notice is due at that first contact or first disclosure. The notice must name the source.
• Processor (enriches your data on your instructions): Article 28 applies. From the regulation text: the processor needs your prior written authorisation before using sub-processors, must pass the same obligations down to them, and stays liable to you for their failures.

The Article 14 duty is why source tracing matters in practice. You cannot write a compliant notice that names the source of a record if neither you nor the supplier can say where it came from.

Which state data broker registries must the supplier be in?

Check every state registry where the supplier's activity triggers registration, not just California's. At the time of writing, four state registries are open (California, Oregon, Texas, and Vermont), and Connecticut and New Jersey have passed registration laws with registries scheduled to open.

"Knowledge required" means the state only regulates brokers that knowingly trade in personal data. Oregon and Texas drop that requirement, so more firms fall inside their definitions, and the counts show it. In one published count across the registries, Texas listed 524 brokers and Oregon 475, against 309 in Vermont and 291 in California. Counts change and sources disagree (another reports California above 600). Read these numbers as a reason to check every state, not as current figures. A supplier can be listed in one state and missing from another.

How to verify this yourself:

1. Search each registry under the supplier's legal entity name, its trading names, and its parent company.
2. Save a dated screenshot or extract of each result to the evidence pack.
3. Where the supplier is missing, get its written reason and check that reason against the state's own definition.
4. Log Connecticut and New Jersey with the date each registry opens, and check again on that date.

I have not verified the exact search URL for each registry or the exact Texas threshold figures. Reach both through the regulator named in the table, and confirm the threshold in the statute before you accept a Texas exemption. Also note that Vermont has passed an amendment that adds purchaser verification requirements. Read the current text to see what it asks of you as a buyer.

Missing registrations carry real penalties for the supplier, which matters when you read its indemnity. Texas penalties start at $100 per day, capped at $10,000 per 12 months. California's privacy agency has settled with two unregistered brokers for a combined $69,800. A supplier that cannot show a registration it plainly needs is either careless or hoping nobody checks, and either way the verdict is Decline.

The questionnaire in the procedure below goes nowhere if it lands with an account executive. The person who can answer it is the supplier's privacy or compliance lead. Refolk finds that person when you describe them in plain English, across LinkedIn, GitHub, and the open web, so the request reaches someone who owns the sourcing.

How many records do you need to trace?

Trace 59 records drawn at random by the buyer, and pass only if none fail. That is the standard attribute-sampling plan for showing, at 95% confidence, that no more than 5% of records fail.

Nobody has published a sampling standard written for data-supplier provenance, so this borrows directly from audit attribute sampling. Attribute sampling tests each item as pass or fail and states the worst failure rate the result can rule out.

Zero-failure plan unless noted. Source: published audit sampling tables.

Two rules follow from the table:

• Fix the plan before you draw. If you want to tolerate one failure, commit to 93 records in advance. Adding records after you have seen a failure breaks the confidence statement.
• Do not go below the table. A 25-record sample with zero failures still leaves a possible 10.3% true failure rate. Reviewers who pick their own sample sizes will reach different verdicts on the same supplier, which defeats the purpose of a standard.

The default is 95% confidence and 5% tolerance. Drop to 29 records only if your policy accepts a 10% tolerable failure rate for low-risk uses, and record that choice in the evidence pack before the draw.

What counts as a pass for one record

A record passes when both reviewers, working separately, can tie it to all of these:

• a named source: a URL or a dataset name, not a category;
• a collection or last-verified date;
• the source's terms or collection notice, and those terms allow the supplier to license the data on;
• field values that match what the source shows.

A record fails if any of these is missing, if the source is only a category such as "public web", or if the supplier cannot answer within the window agreed in the questionnaire. If the two reviewers disagree on a record, it fails until the privacy lead resolves it in writing.

The review procedure, step by step

The review runs in eight steps across three owners: the privacy lead, ops, and legal. Most of the elapsed time goes on supplier turnaround and the 45-day deletion window, so start renewals at least a quarter before the contract end date.

On ordering: the ICO puts lawful basis before you obtain any data, while procurement toolkits tend to put security checks first. I put role and registry first because they are cheap and can end a review in an afternoon. Security attestations matter, but they prove nothing about provenance, so they run alongside this review and never replace it.

Two steps are my proposals, not established practice: record tracing (step 4) and deletion testing (step 5). No published practitioner source documents either one. No published method lets a licensee confirm that deletions reach copies it has already licensed. They are in this standard because nothing else tests the supplier's claims. If your counsel prefers a different test that produces evidence you hold, substitute it and record why.

1. Legal entity, trading names, and parent company.
2. State data broker registrations held (state, registration ID, date), or the statutory reason you are exempt in each state.
3. For each data source: source name or URL, collection method, date range, lawful basis, and the notice shown to individuals at collection.
4. Every sub-supplier that contributes records, with the categories it supplies and the terms that allow onward licensing.
5. For the record IDs listed in the attachment (drawn by us): source, collection date, and source terms for each record, within 10 business days.
6. How deletion and opt-out requests reach your data, your service providers, and copies already licensed to customers, with timings.
7. Regulatory enquiries, enforcement actions, or litigation about your sourcing.
8. Whether you act as an independent controller or as a processor for this engagement.

How do supplier reviews go wrong?

Most failed reviews reach a confident wrong verdict from evidence that only looked like proof. These eight failure modes are the ones to train reviewers on, each with the check that catches it.

1. Registration taken as proof of lawful collection

A registry entry only shows that the supplier has disclosed itself. It is not a verdict on its sourcing. Check the supplier's disclosures and its enforcement history, not just whether it is listed. A listed supplier with category-only sources still fails.

2. Exemption claimed without proof

A supplier says "we're not a broker" because it has some direct relationship with the people in its data. Check each state's definition, not the supplier's summary of it. Texas applies thresholds, and New Jersey's "data collector" category covers businesses with direct relationships. An exemption that cannot be tied to statutory wording is a failed criterion.

3. Source traced only as far as a category

"Public web", "partner network", and "proprietary sources" are not sources. Fail any record that cannot be traced to a URL or dataset name and a date. This is the most common way a trace that looks clean turns out to be empty.

4. Sample chosen by the supplier

A curated sample will pass. The buyer draws the record IDs at random from the supplier's full deliverable, or from the file actually delivered on a renewal, and sends the list. If the supplier offers "representative examples", decline them politely and send your own list.

5. One failure rounded away

One failure in 59 looks like a 1.7% failure rate, but the upper bound at 95% confidence is 7.8%. Under a 5% tolerance, that is a fail. The reviewer who calls it "basically clean" and the reviewer who calls it a fail are applying different standards, and this standard says it fails.

6. Deletion tested only at the supplier's API

Exports you have already licensed keep the deleted data. California's DROP, the state's central deletion-request platform, requires brokers to download requests at least once every 45 days, process them within 45 days, keep deleting a matched consumer's non-exempt data at least every 45 days after that, and direct their service providers and contractors to delete too. A buyer holding a licensed copy sits outside that duty unless the contract brings it in. Query your CRM and ATS copy as well, not just the supplier's API.

7. Contract treated as the evidence

This is the ICO's own worked failure case: a broker with no evidence and a buyer whose only due diligence was a contract term. Warranties and indemnities move liability after the fact. They do not show that anything was collected lawfully.

8. Recruiting data treated as only a privacy question

In Kistler v. Eightfold AI, the complaint alleges that a hiring platform "collects extensive applicant data - including social media profiles, LinkedIn histories, location data, and online activity - to create individualized 'likelihood of success' assessments", and so operated as an unregistered consumer reporting agency. The complaint alleges data on over one billion workers. Eightfold says its data was shared intentionally by candidates or provided by customers. That defence turns on provenance, not bias, which is why recruiting buyers need source tracing as much as sales teams do. The case is in federal court in the Northern District of California, and the motion to dismiss was undecided at the time of writing; check the docket for its status. FCRA statutory damages run from $100 to $1,000 per willful violation. Send any recruiting purchase to counsel for a separate FCRA review. This standard does not settle that question.

How do you turn the evidence into a verdict?

Apply the verdict rules in order, and stop at the first rule that matches. A Decline trigger overrides everything below it. Conditional exists only for gaps that can be closed by a date without changing the collection evidence.

The rules, written so two reviewers apply them the same way:

1. Decline if any of these hold: a required registration is missing without an exemption tied to statutory wording; any source is declared only as a category; any sub-supplier is unnamed; the supplier refused to trace buyer-drawn records; the 59-record trace has one or more failures that the privacy lead has not resolved through a fresh random draw from the cleaned dataset.
2. Conditional if no Decline trigger holds, but the deletion test is still inside its 45 to 90 day window, or one or more required clauses are agreed but not yet signed. Each condition gets an owner and a date. An unmet condition on its date becomes Decline.
3. Contract if every criterion passes on evidence held in the pack.

The clauses that pass risk back

Legal checks for each of these and records whether it is present, agreed, or missing:

• Source warranty: the supplier warrants that each source is lawful and that it can trace any record on request.
• Audit right: you can test provenance again, including fresh random traces, during the term.
• Indemnity: covers claims arising from unlawful collection or a failure to register.
• Liability cap carve-out: regulatory fines and class-action settlements sit outside the standard cap, as employment counsel recommend for AI hiring tools. With a DROP fine of $200 "for each deletion request for each day the data broker fails to delete information", a capped indemnity can be worth far less than it looks.
• Deletion SLA and flow-down: the supplier notifies you of deletions and opt-outs affecting licensed records within a set time, and you agree to delete them from your copies.
• Sub-supplier control: for processors, prior written authorisation before new sub-processors, with the same obligations passed down.

A capped indemnity against uncapped regulatory exposure is a discount, not a transfer of risk.

Supplier (legal entity):
Use: recruiting sourcing / sales prospecting / both
Role: independent controller / processor - reason:
Registries: CA [ ] VT [ ] TX [ ] OR [ ] - screenshots dated:
Exemptions claimed and statutory basis:
CT / NJ follow-up date:
Questionnaire: all sources named Y/N - sub-suppliers named Y/N
Trace plan (confidence / tolerance / n), fixed before draw:
Trace result: reviewer A failures __ / reviewer B failures __
Deletion test: submitted __ / requery date __ / supplier clear Y/N / CRM-ATS copy clear Y/N
Clauses: warranty / audit / indemnity / cap carve-out / deletion SLA / sub-supplier control
Article 14 notice due by:
FCRA review routed to counsel (recruiting use): Y/N
Verdict: Contract / Conditional / Decline
Conditions, owners, dates:
Reviewers and date:

Pre-signature checklist and keeping the verdict current

A verdict is only valid for the evidence it was graded on. Run the checklist before signing, then check the verdict again whenever one of the triggers below fires.

When to grade again

• Every January 31: California and Vermont registrations renew annually. Check that the supplier's entries are current.
• When Connecticut and New Jersey registries open: check the supplier is registered before it sells or licenses data in those states. New Jersey also requires some data collectors to register, so check suppliers that previously claimed an exemption.
• When Vermont's purchaser verification rules take effect: read what they require of buyers and add it to the checklist.
• Every renewal: draw a fresh random sample of 59 records from the current deliverable. Last year's trace says nothing about this year's sources.
• When the supplier adds a source or sub-supplier: treat it as a new review for that source.
• When regulator guidance changes: at least one secondary source reports that the ICO's guidance on using data broking services is under review. Check the ICO's guidance page before each annual cycle.
• When Kistler v. Eightfold AI is decided: a ruling on the consumer-report theory changes the risk for recruiting purchases. Check the docket and brief counsel.

This standard applies to every supplier, Refolk included. If you use Refolk to source candidates or prospects, put it through the same questionnaire, trace, and verdict record as any other supplier. A standard that exempts its own author is not one anyone can rely on.