Introduction: When Helping People Means Handling Their Data
Every day, humanitarian workers are in the field reaching out to some of life’s biggest challenges. Whether it’s refugees escaping conflict or families having trouble putting food on the table, non-governmental and international aid groups are gathering the info they need to help with your situation and get resources to the right people.
Don’t lose sight of the fact that every entry in this data represents an actual human being. It might be a mother having to be supported with food, a family in displacement, or a child in transit living in a center. It might be data about a location, family information, financial data, identity documents, or available assistance.
Here’s the thing: How do humanitarian organizations use this data to enhance aid delivery while protecting you and those in need?
This debate reared its head again in 2019 when the UN’s World Food Programme signed a five-year, $45 million deal with a US data analytics company called Palantir Technologies to standardize operational data and improve the speed of food and cash assistance delivery. Not everyone was pleased. Privacy International was among the critics worrying about data security, surveillance, and harm to vulnerable populations.
Well, why are we hearing about it again then? Privacy International flagged new risks of the partnership in June 2026, including concerns about informed consent, data ownership, and the role that private technology companies are increasingly playing in the humanitarian sector.
This question is not confined to a single coalition. It’s a bigger problem for the sector: How do you innovate with tech without breaking privacy, accountability, and assuming all risks?
Understanding the WFP and Palantir Partnership
Ever wondered how the world’s largest humanitarian agency addresses hunger? That’s exactly what the World Food Programme (WFP) does at scale. Providing emergency assistance to millions of people in conflict, disaster, and economic collapse. But it’s not always as simple as it sounds; thousands of suppliers, transportation routes, warehouses, local partners, and distribution points and a changing set of needs during an emergency can be only a few, and even small differences at that scale can impact tens of thousands of individuals. How do they do it?
A February 2019 WFP news release highlighted a partnership with Palantir that was meant to change the entire way in which WFP operated: “The WFP and Palantir plan to leverage the Palantir Foundry software platform to integrate operational information from across WFP’s five divisions so that staff can analyze data more effectively, plan supplies more efficiently, and make more informed decisions.” Who wouldn’t?
WFP viewed the deal as an opportunity to accelerate efficiency and cut costs in the field. They would make use of enhanced data analytics to pinpoint bottlenecks in the supply chain, coordinate the flow of shipments, and deliver aid to those requiring humanitarian supplies. But, as you can imagine, the deal had its opponents.
Concerns emerged about who should be given access to the data, what data should be used, and what security measures should be put in place when dealing with private tech firms. Privacy International spoke of dangers in linking large data sets, especially for vulnerable groups. Even if direct identifiers were stripped out, other data could still be used to identify individuals or groups.
Another is to keep apart the matters that the alliance highlights from those it buries. The WFP stated that Palantir would not have access to information that could identify the aid recipients and that its data would be safe. But privacy organizations said that safeguards should include safeguards against re-identification, inferences, and longitudinal data sharing.
So is the question merely, “Should we focus only on our own personal data and their security and that of commercial and governmental data, or should we be concerned with the sums of it, or indeed the factors that go into it, as well?”
Why Data Privacy Matters in Humanitarian Work
Have you ever considered data privacy as just a matter of tech with passwords, firewalls, and security platforms? Well, here’s the thing, in humanitarian contexts, it’s all about much, much more.
You are already in danger from violence, fleeing from violence, or where you are from being forcibly displaced. If your personal identity or your position is uncovered, it could be life-threatening for you.
Suppose a refugee family makes a border crossing to escape persecution. They give personal details to an aid agency in return for food, shelter, and medical aid and expect their details will be used to aid them and not to disclose their whereabouts to those who would hurt them.
Or think about a woman getting cash assistance. She doesn’t want her household information or whereabouts to be revealed to anyone. The information she receives on a daily basis can be life-altering for a woman in an abusive situation.
So international humanitarian agencies must treat personal information as they do the body and character of the people they are trying to help. Did you realize that privacy isn’t simply about protecting secrets?
It’s just being careful that those who come forward for help aren’t putting themselves at any more risk. So next time you think about data privacy, think: it’s all about safeguarding (not passwords).
The Hidden Risk of Re-Identification: Can Anonymous Data Still Identify Someone?
One of the most important concerns raised by privacy advocates is the risk of re-identification.
Organizations sometimes remove names, phone numbers, identity numbers, and other direct identifiers before sharing information with external partners. This process is often called de-identification or anonymization, depending on the methods used and the level of protection achieved.
Removing direct identifiers is an important safeguard, but it does not always guarantee anonymity.
Information that appears harmless on its own may become revealing when combined with other datasets.
For example, imagine a database containing the following details about a fictional aid recipient:
- The person lives in a particular rural district.
- They belong to a small household.
- They received assistance on a specific date.
- They travelled from a particular settlement after a local emergency.
None of these details necessarily identifies the person individually. But if another dataset contains information about household size, travel patterns, or recent displacement, it may be possible to connect the records and identify the individual.
The risk becomes more significant in small communities, where fewer people share the same characteristics or circumstances.
In humanitarian settings, location and movement data can be particularly sensitive. Information showing where displaced families have travelled, where aid is distributed, or which communities receive assistance may reveal patterns that were never intended to be made public.
Privacy International raised this concern in its criticism of the WFP–Palantir partnership, arguing that the nature of humanitarian data can make re-identification possible even when names are not shared.
This does not mean that every shared dataset will identify individuals or that every analytics platform creates the same level of risk. The actual risk depends on the information collected, how datasets are combined, who can access them, and what safeguards are in place.
The lesson for NGOs is clear: removing names is only one part of data protection. Organizations must also consider what other information could reveal about the people behind the records.
How Data Misuse Can Put Vulnerable Communities at Risk
The consequences of poor data protection extend beyond privacy violations. In some circumstances, the misuse of humanitarian information could threaten people’s safety, freedom, or access to essential services.
1. Risks to refugees and displaced people
Refugees and displaced communities may be escaping conflict, persecution, or other dangerous situations. Information about their identity, location, family members, or movements can be extremely sensitive.
If such information reaches unauthorized individuals or institutions, it could expose people to unwanted surveillance, discrimination, harassment, or other forms of harm.
For this reason, humanitarian organizations need to carefully assess whether collecting or sharing particular information is genuinely necessary.
2. Surveillance beyond the original purpose
Data obtained for one purpose may be used for another.
Another could be data collected to distribute food aid that might be later used for population monitoring, management, or other analyses. These unintended uses are often made possible through a single large interconnected database rather than planned in advance.
This is what’s called function creep, where the use of the data becomes broader than the reason it was originally collected.
Strict rules should be put in place to avoid humanitarian data being used for anything other than its original purpose without the correct legal authorization and safeguards in place and consideration for the implications for the population.
3. Discrimination and exclusion from essential aid
Data systems may give rise to risks of their own if they involve missing data, inaccurate data, or misinterpretation.
A community may be incorrectly labelled as being assisted. Identification information for an individual may be in error. An automated process may refer an application for follow-up as a result of a mismatch of information.
It may prevent an eligible individual from receiving it. If staff rely on the records.
Furthermore, organizations ought to have systems in place to rectify their records, audit critical decisions, and provide support for individuals when their digital systems go down.
4. Loss of trust in humanitarian organizations
People often share sensitive information with NGOs because they believe the organization is there to help them.
If communities discover that their data has been shared without adequate explanation or protection, that trust can weaken. People may become reluctant to register for assistance, disclose important information, or participate in future programmes.
This can make humanitarian work more difficult and potentially prevent vulnerable people from receiving the support they need.
Trust takes time to build, but it can be damaged quickly when people feel that their information has been handled carelessly.
The Challenge of Informed Consent in Humanitarian Settings
Here’s something to think about: how much do we really know about giving consent when it really counts? In your daily life, you choose whether to provide your data to a company or use a digital tool. Humanitarian contexts are a different story.
Suppose you are starving and in need of food, a roof over your head, medicine, or money – the things you need to survive. Can you afford to refuse to give that info to an aid organization? Is there really any choice in “no”?
You might be okay to pass on your information without knowing exactly how it will be stored or who will have access to it. And those issues don’t even cover third-party companies! Language differences, lack of computer knowledge and emergency situations make it even more complicated. Are you okay with that?
For NGOs, responsible data collection should involve more than asking people to accept a lengthy privacy notice. Organizations should explain, in accessible language:
- What information is being collected and why.
- How the information will be used to provide assistance.
- Which external organizations or service providers may access it.
- How long the information will be retained.
- What rights people have to ask questions, correct errors, or raise concerns.
- Whether alternative ways of accessing assistance are available when sharing certain data is unnecessary or disproportionately risky.
Organizations must also recognize that consent alone does not eliminate every risk. Sensitive data may require stronger safeguards even when individuals have agreed to its collection or use.
The aim should be to respect people’s choices and dignity rather than treating data collection as an automatic condition of receiving help.
Why Partnerships Between NGOs and Technology Companies Need Greater Accountability
Did you know tech firms have the potential to transform how humanitarian organizations work? Think of the impact of data analytics platforms on supply chain, identifying aid gaps, and improving operational planning. When NGOs are managing multiple crises, they can be powerful.
Here’s the rub: tech partnerships are hard. How do you decide what datasets get shared, and who can access them? What happens at the end of the contract? Can you leverage the data on some other analytical product? How do you protect the data in the case of a breach?
By all means, get these questions out of the way well before you enter a partnership – not when you’re knee-deep in the pile. Then, say, take the WFP-Palantir deal. Despite its focus on improving humanitarian efforts, critics at Privacy International questioned if the current protections adequately addressed the potential dangers of aggregating and analyzing private data.
Fast-forward to June 2026, and Privacy International continue to warn of its expansion. They raise issues of informed consent, data rights and possible use of data from humanitarian partners.
And it’s not just the large international NGOs like the UN. Small NGOs will also need to turn to external cloud software, donor management software, digital registration platforms, AI and more.
The organization may at least store information about survivors of violence, children, refugees, or victims of emergencies financially. As such, even a small organization with limited resources should not rush into a partnership with a tech provider without doing their homework: investigate the provider, request contractual safeguards, analyze human rights risks, and establish monitoring procedures.
Keep in mind, a company’s technical ability is only part of the story. We also need to consider their openness, security, accountability and how they intend to treat the data. How do you verify this in your partnerships?
What NGOs Can Do to Protect Sensitive Data
Protecting humanitarian data does not necessarily require organizations to stop using technology. Instead, NGOs need a practical approach that balances the benefits of digital tools with the potential risks.
1. Collect only the information that is necessary
The first step is to ask a simple question: do we genuinely need this information to deliver the service?
Collecting additional personal details without a clear purpose increases the amount of information that must be protected. Data minimization helps reduce this risk.
For example, a food distribution programme may need to confirm household eligibility and the number of people requiring assistance. It may not need to collect unrelated personal information that does not improve the service.
2. Conduct a data protection impact assessment
Before introducing a new database, digital registration system, or analytics platform, organizations should assess how the system could affect the people whose information it processes.
This assessment should identify the type of information collected, potential threats, access arrangements, storage practices, and possible consequences if the data is exposed or misused.
Particular attention should be given to groups facing heightened risks, including refugees, children, survivors of abuse, and people living in conflict zones.
3. Use strong security measures
Sensitive information should be protected through appropriate technical and organizational safeguards.
These may include encryption, secure authentication, access controls, regular security testing, and procedures for responding to data breaches.
Access should be limited to people who genuinely need the information to perform their responsibilities. External technology providers should receive only the access required for their specific role.
4. Set clear rules for third-party data sharing
NGOs should establish written agreements with technology providers that specify how information may be accessed, processed, stored, and shared.
Contracts should address data ownership and control, restrictions on secondary use, retention periods, deletion procedures, incident reporting, and independent oversight where appropriate.
Organizations should also review whether a provider’s systems or subcontractors could introduce additional risks.
5. Establish clear retention and deletion policies
Keeping data indefinitely can increase the potential harm caused by a security breach or unauthorized access.
NGOs should define how long different categories of information need to be retained and establish secure deletion procedures when the information is no longer necessary, subject to applicable legal, operational, and accountability requirements.
6. Involve affected communities
People receiving assistance should have opportunities to understand and question how their information is used.
NGOs can consult community representatives, gather feedback, and provide accessible channels for reporting privacy concerns. These conversations can help identify risks that may not be obvious to technical teams or senior management.
Community participation is especially important when digital systems are introduced in places where people have limited control over the conditions under which assistance is provided.
7. Keep human oversight in important decisions
Digital tools can support decision-making, but they should not automatically determine whether someone receives essential assistance without appropriate safeguards.
When a system produces an unexpected result, trained staff should be able to investigate the issue, correct errors, and provide a fair review process.
Technology should help humanitarian workers understand people’s needs, not replace their responsibility to protect the people they serve.
The Role of Responsible AI in Humanitarian Data Protection
AI is shaking up the world of nonprofit organizations but, what about privacy? With artificial intelligence on the rise, the topic of privacy has never been more important.
You see, AI systems can analyze vast amounts of data, detect trends, and help organizations plan their services. But to be sure, those abilities may also risk revealing unintended associations or attributes when data sets are merged.
Imagine it: an AI applies location data, household files, distribution histories of aid, and demographic data to identify needs within the community. Useful for planning, sure. But it can also expose sensitive information if you’re not careful.
What if AI predictions aren’t right? If the wrong data enters the machine, an organisation could have leading or false information about a household or community. And if the staff members or system take this information to be true, then support can be wrong.
It’s obvious that responsible AI use is not just about choosing a good tool. An NGO must understand: What data the tool uses, whether the provider keeps that data, how they plan to use the outputs, and whether the tool has been evaluated for potential risks.
For organizations, it’s essential to avoid entering any names or other identifiable information about a beneficiary into a public AI tool unless they have verified that the tool itself, the settings, and its use are all appropriate to protect sensitive data.
At the end of the day the objective hasn’t changed: using technology to support humanitarian work while safeguarding the safety, dignity and rights of affected populations. How will you protect your organization from AI misuse?
Balancing Innovation With the Humanitarian Principle of Doing No Harm
Interested in how humanitarian organizations can balance the urgent need to provide assistance? As you may have already guessed, digital tools can be huge in any large-scale crisis situation – but here’s the truth: efficacy is not the be-all and end-all.
Think of a system that lowers administration costs but introduces risks, such as revealing confidential information. Or consider a database that enhances collaboration but explains little to users as to how their information will be used. Or a sophisticated analytics platform that provides insights but at the same time raises fears of surveillance. So, what do you do?
“Doing no harm” is another one of the prompts that calls on organizations to consider these trade-offs before adopting new technology. It means that you have to consider not only if something is effective, but how it could be exploited, who might be harmed, and whether the benefits can be had in a less harmful way.
And remember, those on the receiving end aren’t just data on some computer somewhere – they’re also people with needs and concerns that go beyond just data in a database.
For NGOs, responsible innovation begins with keeping communities and their safety at the core of their tech decisions. In your opinion, how can organizations ensure they’re being both effective and responsible?
Conclusion: Protecting People’s Data Is Part of Protecting People’s Lives
Is tech a hero or villain of humanitarian aid? Here’s how the World Food Programme’s new partnership with Palantir has caused a global debate. Let’s get into it! Tech & Responsibility: Let’s put this debate to rest!
You likely already know that data analytics can be a business must-have, allowing organizations to seamlessly coordinate relief efforts, enhance planning and find efficiencies with shrinking resources. But, simply put, there can be risks involved when data is collected and shared. Some data might be shared without privacy safeguards or may be compiled in new and unanticipated ways, not to mention used outside of its intended purpose.
Privacy International’s issues should be a wake-up call. Humanitarian actors need to be cautious about what’s enticing about digital transformation. They need robust data protection-transparency, thorough risk assessments, real community involvement, contractual protections, and accountability over time.
For an NGO or a nonprofit, it’s not simply a technical obligation. It’s about respecting the relationship that your organization has with the people it exists to serve. When a person provides their personal information in order to get some food, some healthcare, some rent, or some cash, they trust your NGO.
So, what metric is most appropriate to evaluate the effectiveness of humanitarian tech: the amount of money it saves us? How quickly it allows us to process the data? Or whether it actually helps people without putting them in danger?
Technology should make humanitarian assistance more effective, not make vulnerable people more vulnerable.
