Back to the journalData Annotation Security: NDAs, PII and Access Controls
Short answer: secure data annotation combines legal controls (NDAs and data processing terms), technical controls (role-based access, restricted environments, no local downloads, encryption), people controls (trained, named annotators) and process controls (redaction of personal data, retention limits, deletion at the end and audit logs). Ask any annotation partner to show how each one works in practice.
Four layers of annotation security
| Layer | What to look for |
|---|---|
| Legal | NDA, data processing terms, clear ownership of labels and outputs |
| Technical | Role-based access, SSO where possible, encrypted transfer and storage, restricted or virtual environments, download and screenshot controls where required |
| People | Named, trained annotators; access only to the projects they work on; offboarding that removes access |
| Process | Redaction of personal data, minimum data needed, retention limits, verified deletion, audit logs |
Handling personal data (PII)
Images, video, audio and text often contain names, faces, number plates, phone numbers or health information. Good practice:
- send only the data the task needs;
- redact or blur personal details where the task allows;
- de-identify medical data before sharing;
- keep a record of who accessed what and when.
Rules differ by country and industry, so confirm requirements with your own legal or compliance team.
Questions to ask an annotation partner
- Who will see our data, and how is their access limited?
- Can work happen inside our own tool or environment?
- Can annotators download, copy or screenshot data?
- How is data transferred and stored?
- How long is data kept, and how is deletion confirmed?
- Is there an audit log of access?
- Which certifications do you hold, if any? Ask for the certificate rather than relying on a logo.
Working in the client's own environment
The strongest setup for sensitive data is often to keep the data in your own cloud or tool and give the annotation team limited, logged access. The data never leaves your control.
Have a dataset in mind?
Start with a Free Calibration Pilot