Lesson 1.2: Data Types & Risk

Common data

As the term implies, common data is information that’s widely used, well understood, and historically accepted within regulated financial activity.

Examples include market prices, security identifiers, issuer fundamentals, economic indicators, and standardized client account information. It’s typically sourced from established providers or internal systems built for regulatory compliance.

Because common data is familiar, it’s often treated as low risk. That assumption is only partially correct. It still carries obligations around accuracy, timeliness, suitability, and use. However, the regulatory expectations around it are generally clearer, and supervisory frameworks are more mature.

The key point is not that common data is “safe,” but that its risks are known and legible. Proper disclosure of the source of the data in public-facing material is generally understood.

Alternative data

Alternative data includes information that falls outside traditional financial datasets but is used to generate insights, signals, or classifications.

This can include transactional metadata, geolocation patterns, web activity, satellite imagery, sentiment indicators, or aggregated behavioral signals. The defining feature is not novelty, but contextual ambiguity.

Alternative data often raises questions that regulators care deeply about:

• Why does this data exist?

• How was it collected?

• What permissions govern its use?

• What assumptions are embedded in it?

Even when alternative data is aggregated or anonymized, its interpretation can introduce bias, privacy risk, or suitability concerns. These risks are often less obvious than with common data, which makes them harder to supervise.

The moment alternative data is used to inform decisions, segmentation, prioritization, or recommendations, it becomes a governance issue—regardless of whether it’s client-facing.

Derived data

Derived data is created when existing data is transformed, combined, summarized, scored, labeled, or inferred.

This includes rankings, risk scores, client segments, propensity indicators, summaries, classifications, and model outputs. Derived data doesn’t exist independently. It reflects the assumptions, logic, and objectives embedded in its creation.

From a regulatory perspective, derived data is often where risk concentrates. Even when inputs are permitted and well understood, derivation introduces:

• New meaning

• New potential for error

• New documentation obligations

• New supervisory responsibility

Importantly, derived data may appear objective or technical while still encoding judgment. That judgment must be explainable.

Why does risk increase as data moves downstream?

As data moves from common to alternative to derived forms, three things tend to happen simultaneously.

First, interpretive distance increases. The further the data moves from its original source, the harder it becomes to explain what it truly represents.

Second, accountability becomes less obvious. Responsibility can become diffused across systems, teams, or vendors.

Third, documentation gaps emerge. Transformations that feel routine are often poorly recorded, even though they materially affect outcomes.

This is why regulators focus not just on original data sources, but on how data is transformed and reused over time.

A simple rule for governance

A useful mental model is this:

The more interpretation a dataset contains, the more governance it requires.

• Common data generally requires baseline controls.

• Alternative data requires contextual review and justification.

• Derived data requires explicit documentation, supervision, and explainability.

This rule applies regardless of whether AI is involved.

Let’s consider an example. A dataset may begin as common data, such as standard client account and transaction records used for reporting or operations. When that same data is combined with additional signals or contextual indicators to identify patterns or segments of interest, it functions as alternative data, reflecting interpretive choices about relevance and purpose. If those signals are then transformed into outputs such as rankings, scores, or prioritization lists that guide decisions or communications, the result is derived data.

While the underlying information may remain familiar, each step embeds additional meaning and judgment. As a result, interpretive distance increases, accountability becomes less obvious, and documentation requirements escalate—illustrating why regulatory risk rises as data moves from common to alternative to derived forms.

Why this matters before analytics or AI

Analytics and AI accelerate the use of derived data.

If a firm does not clearly understand which data is common, which is alternative, and which is derived, it cannot reliably assess risk, assign accountability, or respond to regulatory questions.

Most AI-related incidents trace back to poorly governed derived data—not exotic models.

This lesson is about recognizing where meaning changes, not about restricting innovation.