Public starter workbook

AI data safety starter workbook.

This workbook helps NGO teams prepare safer AI and digital workflows before they upload, summarize, translate, analyze, or share information. It is a training aid only. It is not legal advice, a GDPR audit, safeguarding assurance, donor approval, or a security certification.

Do not use real beneficiary, survivor, staff, partner, donor, location-security, medical, legal, or confidential organization data in public previews, public AI tools, or unapproved training submissions.

1. Data sensitivity map

List the information your team handles and classify it before choosing a tool.

Data type	Example	Risk level	Handling rule
Public	Published report title	Low	Can be used in public prompts if accurate and attributed.
Internal	Draft workplan	Medium	Use only in approved work tools with team access controls.
Confidential	Donor budget notes	High	Redact or summarize internally; do not upload to public AI tools.
Sensitive	Beneficiary, survivor, staff, location, security, or case data	Critical	Do not use in AI tools unless formally approved, protected, and necessary.

2. Safe prompt preparation

Remove identifiers

Names, phone numbers, emails, addresses, precise locations, case IDs, photos, and unique personal details.

Use fictional examples

Replace real cases with invented examples that preserve the learning task without exposing people or organizations.

Limit purpose

Only include the minimum context needed for the specific output.

Review before sharing

A human owner must check facts, tone, safety, bias, unsupported claims, and confidentiality before use.

3. Access-control check

Who can open the folder, file, tool, or dashboard?
Are external links restricted, expiring, or password-protected where needed?
Is multi-factor authentication enabled for accounts handling sensitive work?
Are shared accounts avoided?
Is there a staff offboarding checklist for tool and folder access?

4. Incident first response

If data is uploaded to the wrong tool, sent to the wrong person, exposed through a public link, or used in an unsafe AI output, record the incident quickly and escalate without delay.

What happened?
What data may be affected?
Who may be affected?
What immediate containment action was taken?
Who was informed?
What needs to change to prevent recurrence?

Back to course pathway