On this page
Six passes for the pack
- Choose the question. Are you showing format, language, history, labels, linked records or task diversity? Write the question before selecting rows or files.
- Set the boundary. Record systems, dates, versions, formats, excluded channels and the license or review purpose. Do not let a sample silently expand the proposed scope.
- Mask and remove. Remove credentials, direct identifiers, customer-confidential material, HR and legal records. Keep a private redaction log that says what rule was applied without retaining the exposed value in the public artifact.
- Add context. Include a data card with contents, dates, languages, formats, known gaps, provenance and the fields that are absent. A reviewer should not have to infer what a blank field means.
- Approve the release. Confirm the owner or authorized role approved the exact sample, recipient, purpose and transfer path. Record the date and the approval reference.
- Transfer safely. Use the approved NDA and scoped, logged path. Give the recipient the minimum access needed and record when access is revoked or the sample is deleted.
Sample-pack worksheet
| Pack item | Example value for a fictional pack | Owner decision |
|---|---|---|
| Review question | Can a reviewer assess thread structure and metadata? | Keep the sample narrow |
| Source and period | Synthetic team archive, stated period | Confirm scope and provenance |
| Included material | Redacted records and metadata only | Approve fields and links |
| Excluded material | Direct messages, HR, legal, customer records, secrets | Keep out and document |
| Data card | Formats, languages, dates and known gaps | Attach to the same review |
| Masking record | Rule names and review date | Retain privately |
| Approval | Authorized owner role and dated approval | Do not send without it |
| Transfer | NDA, controlled path, recipient role and expiry | Log access and deletion |
A fictional example
For a fictional support archive, the pack could contain a handful of synthetic tickets, thread structure, timestamps shifted for privacy, a data card and an exclusions note. It should not contain a real customer message, a live account identifier or a full export. The reviewer can see whether the format and fields are useful. The owner can still change the scope before any license is signed.
The UK Information Commissioner’s Office guidance on data protection by design Information Commissioner’s Office (UK), (opens in a new tab) says to map personal information and risks from the start, limit use to what is necessary, and explore masking or pseudonymization as appropriate. Use that as a design prompt. It is not a certification of your masking method.
General information, not legal advice.
Keep the sample honest
Label synthetic material as synthetic. Label redacted or transformed fields. Do not use a tiny easy slice to imply the full archive has the same coverage. Keep known gaps visible. If the source includes health records, stop at the current Rightmark Trust status sentence: “Rightmark does not take health data yet (patient records, medical imaging or veterinary records), until a HIPAA program and vendor agreements are in place.” Do not prepare an intake sample.
Sources
- Rightmark: Buyers
- Rightmark: Trust and compliance
- Information Commissioner’s Office (UK): Data protection by design and by default (opens in a new tab)