Artificial Intelligence (AI) is changing the way non-governmental organizations (NGOs) and humanitarian agencies operate. From identifying communities that need emergency assistance to analyzing project data, managing beneficiary records, preparing funding proposals, and improving disaster response, AI is opening new possibilities for the nonprofit sector.
For organizations working with limited resources and growing humanitarian needs, these technologies can make everyday operations faster and more manageable. AI can help teams process information, reduce repetitive administrative work, identify patterns, and make better use of available resources.
However, behind these benefits lies an important concern that humanitarian organizations cannot afford to ignore: What happens to the personal information of the people these organizations are trying to protect when AI becomes part of their work?
NGOs will have a database of data collected from refugees, displaced families, children, survivors of violence, poor people, and communities in natural disasters or an armed conflict. They require it for providing food, health, shelter, education, financial support, etc.
However, when this information is left in unprotected and open databases, given to third-party technology providers, or even fed into AI systems, it can pose significant threats.
One data breach is all it takes to reveal someone’s identity, location, family, medical condition, or life circumstances. And in some humanitarian circumstances, information could even be life-threatening.
Why Safeguarding Must Come First describes these issues. It notes that vulnerabilities of the current humanitarian data management systems could be exacerbated by greater use of AI tools by actors working in the sector.
Of course, the conversation also begs an even bigger question: Humanitarian groups are already deploying AI; they just haven’t put policies in place explaining how staff should use the tools or safeguard data.
This entails that data protection is something that is the responsibility of everyone, even non-IT staff. It is also linked to the respect for humanitarian principles, human rights, organizational accountability, and the security of the vulnerable.
Understanding Humanitarian Data: Why Is It So Sensitive?
Before understanding the risks of AI, it is important to understand the type of information humanitarian organizations collect.
When an NGO provides assistance to a community, it needs information to understand people’s situations, identify their requirements, and make sure resources reach those who need them.
For example, an organization supporting refugee families may collect:
- Personal information, including names, ages, and contact details.
- Identification documents and registration numbers.
- Current addresses and geographical locations.
- Family details, including the number of household members.
- Medical records and information about health conditions.
- Financial information, income details, and employment status.
- Information about displacement, migration, or previous experiences of violence.
- Photographs, fingerprints, and other biometric information.
- Details about access to food, clean water, education, and shelter.
This information helps humanitarian organizations understand community needs and deliver assistance more effectively.
However, the sensitivity of this information makes it particularly important to protect.
Consider a refugee family that has escaped conflict and is living in a temporary settlement. An NGO collects their names, previous addresses, family details, and registration information to provide food and shelter.
If this information becomes publicly accessible or reaches unauthorized individuals, it could expose the family to harassment, discrimination, surveillance, or other threats.
Similarly, information about a survivor of domestic violence or human trafficking must be handled carefully. Revealing their identity or location could put them in immediate danger.
This is why humanitarian data cannot be treated like ordinary business information. It represents real people, their personal experiences, and sometimes the circumstances that forced them to seek assistance.
As AI makes it easier to collect, combine, analyze, and transfer large amounts of information, organizations must become even more careful about how they handle it.
Real-World Incidents: What Happens When Humanitarian Data Is Exposed?
Data security is not a new challenge for humanitarian organizations. Several incidents have already demonstrated how the exposure or inappropriate sharing of personal information can create serious concerns for vulnerable communities.
These examples are especially important as NGOs introduce more digital platforms and AI-powered systems into their operations.
1. World Food Programme: Personal Information of Around 600,000 Gaza Households Exposed
One of the most concerning recent examples involves the World Food Programme (WFP).
In June 2026, The New Humanitarian reported that a cyberattack had exposed personal information belonging to approximately 600,000 households in Gaza.
The incident involved WFP’s self-registration application, which allowed people to register for food and cash assistance after verification.
The information exposed included names, identification numbers, mobile phone numbers, and location details.
For people living in an active conflict zone, the exposure of this information creates particularly serious concerns. Personal details and location information can be sensitive in environments where people already face threats to their safety and security.
The incident also highlighted the growing dependence of humanitarian organizations on digital registration systems.
Online registration platforms can make it easier for people to request assistance, reduce administrative delays, and help organizations manage large programs. However, they also create databases containing significant amounts of personal information.
If these systems are not adequately protected, the information collected to provide humanitarian support can become a potential source of risk.
This incident raises an important question for NGOs: Are organizations giving enough attention to data security when introducing digital systems to improve program delivery?
Technology can make assistance more accessible, but security must be considered from the beginning rather than addressed only after a breach occurs.
2. International Committee of the Red Cross: Cyberattack Affected More Than 515,000 People
Another important incident occurred in January 2022 when the International Committee of the Red Cross (ICRC) discovered a sophisticated cyberattack targeting its servers.
According to the organization, the attack compromised personal and confidential information relating to more than 515,000 vulnerable people.
The affected information was connected to services provided by the Red Cross and Red Crescent network, including its Restoring Family Links program.
This program helps people reconnect with family members separated by armed conflict, migration, and natural disasters. It also supports families searching for missing relatives.
The exposed information included details about missing people, their families, people in detention, and individuals receiving humanitarian assistance.
For these individuals, personal information can be extremely sensitive. Someone searching for a missing relative may have shared details about their identity, family relationships, or circumstances surrounding their disappearance.
If such information is misused or publicly exposed, it could create additional difficulties for people who are already experiencing distress.
The incident demonstrated that even internationally recognized humanitarian organizations with established operations are not immune to cybersecurity threats.
It also showed why protecting beneficiary information must be considered an essential part of humanitarian responsibility.
3. Rohingya Refugee Data: Why Informed Consent Matters
Data protection is not only about hackers and cyberattacks. Information can also create risks when it is shared inappropriately between organizations or government authorities.
A significant example involves the personal information of Rohingya refugees living in Bangladesh.
In June 2021, Human Rights Watch published findings raising concerns about the sharing of Rohingya refugee information with Myanmar without adequate informed consent in some cases.
The information had been collected through a registration exercise involving UNHCR and the Bangladeshi authorities.
The data included personal and biometric information that was relevant to refugee registration and identification.
Human Rights Watch reported that many refugees interviewed believed their information was being collected to help them access essential services and obtain registration cards. They said they had not been adequately informed about its possible use in assessing eligibility for repatriation.
This raised serious questions about whether people understood how their information would be used and whether they had a genuine opportunity to refuse particular forms of data sharing.
The incident highlights an important principle for all humanitarian organizations: collecting information for one purpose does not automatically mean it should be used for another.
For example, a refugee who provides personal information to receive food assistance should not automatically expect that information to be used for unrelated purposes.
The organization collecting the information must clearly explain its intended use, possible sharing arrangements, and associated risks.
This lesson becomes even more important when AI systems are involved because information collected for one purpose can potentially be combined with other datasets to generate new insights about individuals.
These incidents demonstrate that data protection failures can happen in different ways. They may involve cyberattacks, weak security systems, inappropriate information sharing, or a lack of meaningful consent.
For humanitarian organizations, all these risks require attention.
How AI Is Changing the Risks Associated With Humanitarian Data
AI does not automatically create a data breach. However, it changes how information is collected, processed, stored, and used.
Traditional databases generally store information in organized formats. AI systems can go further by analysing large datasets, identifying connections, generating predictions, and producing conclusions about individuals or communities.
This can be useful for humanitarian planning, but it also introduces additional risks.
For example, an NGO may use AI to analyse thousands of beneficiary records to understand which communities require additional support.
The system may identify patterns based on income, location, family size, medical conditions, and previous assistance received.
However, if the underlying information is inaccurate, incomplete, or sensitive, the AI system may produce conclusions that create problems for the people involved.
The following risks deserve particular attention.
1. Employees May Accidentally Share Confidential Information With AI Platforms
One of the most common risks comes from the everyday use of AI tools by employees.
NGO teams increasingly use AI chatbots and writing assistants to prepare project reports, summarize documents, analyse survey responses, create presentations, and write funding applications.
These tools can be helpful, especially for small organizations without dedicated research or communication teams.
However, employees may not always understand what information they are sharing with external platforms.
Imagine an NGO employee who needs to prepare a report about a healthcare programme.
The employee uploads an Excel spreadsheet containing the names, phone numbers, medical conditions, and addresses of 500 beneficiaries and asks an AI tool to summarize the findings.
The intention may be completely harmless. The employee simply wants to save time.
However, the uploaded document contains much more information than the AI tool actually needs.
Depending on the platform, its settings, and the applicable service agreement, information may be processed, retained, or accessed in ways the organization has not properly evaluated.
This creates unnecessary exposure.
What NGOs can do:
Organizations should establish clear rules about which information employees can share with AI platforms.
Before uploading documents, employees should remove unnecessary personal information and use approved tools with appropriate privacy protections.
If the task only requires calculating the total number of beneficiaries, there is no reason to upload their names, phone numbers, or medical records.
2. AI Can Identify People Even When Their Names Are Removed
Removing someone’s name from a document does not always make the information anonymous.
AI systems can analyse different details and identify connections between them. When several datasets are combined, information that initially appears harmless may reveal someone’s identity.
For example, imagine an NGO preparing an anonymized report containing:
- A person’s age.
- Their village or neighbourhood.
- Their occupation.
- Their family size.
- Their medical condition.
The report does not contain names or identification numbers.
However, if these details are combined with information available elsewhere, it may become possible to identify the individual.
This is known as the risk of re-identification.
The problem is particularly serious in smaller communities, where a combination of personal characteristics may be enough to identify someone.
For refugees and people living in remote areas, even general location information can sometimes reveal more than organizations expect.
What NGOs can do:
Organizations should carefully review information before sharing it with AI systems.
They should remove unnecessary identifying details, combine information into broader categories where possible, and assess whether individuals could still be identified through other available information.
Anonymization should be treated as an important security measure, not a guarantee that information is completely risk-free.
3. AI Can Make Incorrect Decisions About Who Receives Assistance
AI is increasingly being explored for identifying vulnerable households, prioritizing emergency assistance, reviewing applications, and identifying possible fraud.
These applications can help humanitarian organizations process large amounts of information.
However, AI systems are not always accurate or fair.
Imagine an NGO introducing an AI-powered system to identify families eligible for emergency financial support.
The system analyses income, household size, location, and previous assistance records.
A family living in a remote area may have incomplete registration information because they recently moved after a natural disaster.
Another family may not have formal income records because its members work in the informal sector.
The AI system may interpret missing information as a sign that these families are less eligible for support.
As a result, people who genuinely need assistance could be excluded.
This is particularly concerning because people affected by automated decisions may not understand why they were rejected or have a practical way to challenge the outcome.
What NGOs can do:
AI should support humanitarian decision-making rather than replace human judgment.
Employees should review important recommendations, consider individual circumstances, and ensure that people have an opportunity to challenge decisions affecting their access to essential services.
4. AI Can Increase Surveillance and Misuse of Personal Information
AI systems can analyse photographs, location information, communication records, and other digital information to identify individuals and understand their activities.
Although these capabilities may have useful applications, they can also be misused.
For example, information collected by an NGO to provide emergency assistance could potentially be used for purposes unrelated to humanitarian support if it is shared with unauthorized organizations or external partners.
A database containing refugee registration information, family details, and locations could become particularly sensitive if used for surveillance or other purposes that expose individuals to harm.
The risk is not limited to governments. Private companies, technology partners, and other organizations may also have access to information depending on the agreements and systems involved.
What NGOs can do:
Organizations should establish strict rules about who can access personal information and why.
Data-sharing agreements should clearly explain the purpose of sharing, the permitted uses of the information, the responsibilities of each organization, and the safeguards required to protect individuals.
5. AI-Generated Information Can Be Incorrect or Misleading
AI systems can produce incorrect information, misunderstand context, and generate misleading conclusions.
This becomes particularly concerning when organizations use AI to translate beneficiary interviews, summarize community feedback, or analyse reports from humanitarian field workers.
For example, an NGO may use AI to translate interviews with people affected by a local conflict.
If the system misunderstands a culturally specific expression or fails to recognize an important detail, the resulting translation may not accurately represent the person’s experience.
Similarly, an AI-generated summary of community feedback may overlook certain concerns or give greater importance to information that appears more frequently in the dataset.
These mistakes can affect how organizations understand community needs and plan their programmes.
What NGOs can do:
AI-generated information should be reviewed by people who understand the language, local culture, and programme context.
Important decisions should never be based entirely on automated summaries or predictions.
6. Third-Party AI Providers Can Create Additional Data Risks
Many NGOs do not develop their own AI systems. Instead, they depend on external technology providers for cloud storage, communication platforms, data analysis, and AI-powered services.
These partnerships can make advanced technology more accessible to organizations with limited technical resources.
However, they also introduce questions about data ownership, storage, access, and responsibility.
For example, an NGO may use an external platform to store beneficiary information and another platform to analyse that information.
If both services have different privacy policies and data-sharing arrangements, the organization may struggle to understand where information is being processed and who is responsible for protecting it.
There may also be questions about whether information is transferred across international borders or retained after an organization stops using a service.
What NGOs can do:
Before partnering with technology providers, NGOs should review their privacy policies, security standards, data retention practices, and contractual responsibilities.
Organizations should also understand what happens to beneficiary information when a partnership ends.
Technology providers should be selected based on their ability to protect sensitive information, not simply because their products are affordable or convenient.
7. AI Can Reinforce Existing Biases Against Vulnerable Communities
AI systems learn from the information used to train or configure them.
If that information does not accurately represent different communities, the system may produce biased results.
For example, an AI system used to assess humanitarian needs may have more information about urban populations than rural communities.
It may therefore make better predictions for people living in cities while producing less reliable results for remote populations.
Similarly, communities that have limited access to digital services may be underrepresented in the information used by AI systems.
This can create a situation where the people who are already difficult to reach become even less visible in automated decision-making.
Bias can also affect people based on language, gender, disability, ethnicity, age, or economic circumstances.
What NGOs can do:
Organizations should regularly examine whether AI systems produce fair results across different communities.
They should involve local staff and community representatives in evaluating these systems and make sure that people are not excluded simply because their information is incomplete or different from the available training data.
Why Refugees and Vulnerable Communities Face Greater Risks
Data protection is important for everyone, but it becomes particularly critical in humanitarian settings.
People receiving humanitarian assistance may have limited opportunities to control how their personal information is collected and used.
A refugee may need to provide personal details to register for food assistance or temporary accommodation.
A family seeking medical support may have to share health records to receive treatment.
A person escaping domestic violence may need to reveal their location to access protection services.
In these circumstances, people may feel they have no choice but to provide information.
This creates an important question:
Can consent really be considered voluntary when someone feels they must share personal information to receive essential support?
A registration form with a consent checkbox is not necessarily enough.
People must understand what they are agreeing to, why their information is being collected, how long it will be stored, and whether it will be shared with other organizations.
This information should be communicated in a language and format that people can understand.
NGOs should also consider the power imbalance between the organization providing assistance and the person receiving it.
If refusing to share certain information means losing access to essential services, consent may not be genuinely voluntary.
Organizations must therefore explore ways to minimize unnecessary data collection and provide appropriate alternatives wherever possible.
Humanitarian assistance should never become a reason for people to lose control over their personal information.
The Governance Gap: Why Having AI Tools Is Not Enough
One of the key concerns raised by Bond in November 2026 is the gap between AI adoption and organizational governance.
Many humanitarian professionals are already experimenting with AI tools, but organizations may not have formal policies explaining how these tools should be used.
This creates a situation where different employees make their own decisions about what information they can upload, which platforms they can use, and how AI-generated results should be handled.
For example, the fundraising team may use AI to analyse donor information, while programme staff use AI to summarize beneficiary interviews.
The communications team may use AI to prepare reports, and the research team may use it to analyse survey responses.
Each activity may appear harmless on its own. However, without organizational oversight, sensitive information can move between different platforms without anyone having a complete understanding of the risks.
This is why AI governance is important.
AI governance refers to the policies, responsibilities, procedures, and monitoring systems that guide how an organization uses artificial intelligence.
For NGOs, it should answer several important questions:
- Which AI tools are approved for organizational use?
- What types of information can employees share with these tools?
- Who is responsible for reviewing AI-related risks?
- How should sensitive beneficiary information be protected?
- Who can access AI-generated reports and recommendations?
- How will the organization identify and respond to mistakes?
- Who is accountable when an AI system causes harm?
AI governance should not be treated as an additional administrative burden.
It should be connected to existing safeguarding, data protection, cybersecurity, and risk management policies.
How NGOs Can Use AI While Protecting Beneficiary Information
The solution is not to stop using AI.
Artificial intelligence can provide meaningful support to humanitarian organizations, particularly those managing large programmes with limited resources.
However, organizations need to introduce these technologies carefully and establish safeguards before using them in sensitive operations.
Here are practical steps NGOs can take.
1. Develop a Clear AI Usage Policy
Every NGO using AI should have a written policy explaining how employees are allowed to use these technologies.
The policy should identify approved platforms, acceptable uses, restricted activities, and the types of information that must not be shared without authorization.
For example, an organization may allow employees to use AI for:
- Preparing general project descriptions.
- Improving the language of funding proposals.
- Summarizing publicly available research.
- Creating presentation outlines.
- Analysing non-sensitive project statistics.
- Brainstorming fundraising and communication ideas.
However, uploading confidential beneficiary records, medical information, identification documents, or sensitive case notes should require additional approval and appropriate safeguards.
The policy should also explain how employees can report accidental information sharing or suspected security incidents.
Most importantly, it should be understandable to all staff members rather than written only for technical professionals.
2. Classify Information According to Its Sensitivity
Not every document used by an NGO carries the same level of risk.
A public project brochure does not require the same protection as a database containing refugee registration details.
Organizations should classify information according to how sensitive it is and the potential harm that could occur if it were exposed.
For example:
Public information: Published reports, public project descriptions, general awareness materials, and publicly available research.
Internal information: Meeting notes, operational plans, internal procedures, and non-public administrative documents.
Confidential information: Donor records, internal financial documents, staff information, and sensitive organizational communications.
Highly sensitive information: Beneficiary identification documents, medical records, refugee registration details, information about survivors of violence, biometric information, and confidential protection cases.
This classification helps employees understand which information can be used with AI and which information requires stronger controls.
3. Collect Only the Information That Is Necessary
NGOs should avoid collecting more personal information than they actually need.
For example, if an organization is conducting a survey to understand access to clean drinking water, it may only need information about household size, water availability, and general location.
Collecting identification numbers, personal addresses, or unrelated family information increases the amount of sensitive data the organization must protect.
The same principle applies when using AI.
If an AI system only needs general project statistics, there is no reason to upload an entire beneficiary database.
This approach is known as data minimization.
It reduces unnecessary exposure and makes information management easier.
4. Anonymize Information Before Using AI
Whenever possible, NGOs should remove personal identifiers before sharing information with AI tools.
For example, instead of uploading a document containing the names and phone numbers of 200 families, an organization can prepare a version containing only relevant statistics.
Instead of sharing individual medical records, it may use aggregated information showing how many people received healthcare services.
However, organizations must remember that removing names does not always guarantee anonymity.
Other details may still make it possible to identify individuals.
Therefore, anonymization should be supported by careful reviews and additional security measures.
5. Choose AI Platforms Carefully
Not every AI platform is suitable for processing humanitarian information.
Before adopting a service, NGOs should understand how it handles data and what security protections it provides.
Important questions include:
- Does the platform use submitted information to train its AI models?
- How long does it retain uploaded information?
- Who can access the information?
- Is the information encrypted during storage and transfer?
- Can the organization request deletion?
- Does the platform share information with third-party service providers?
- Where is the information stored and processed?
- Does the provider offer appropriate privacy agreements and security controls?
NGOs should not assume that a popular AI platform automatically provides the level of protection required for sensitive humanitarian information.
Each platform should be assessed according to the type of information the organization intends to process.
6. Train Employees on Data Protection and Responsible AI
Technology alone cannot prevent every data protection problem.
Sometimes, risks arise because employees do not understand what information should or should not be shared.
For example, a staff member may upload a confidential project document to an AI chatbot simply because they want a quick summary.
Without proper training, even well-designed security systems can be undermined by everyday mistakes.
NGOs should organize regular training sessions covering:
- Safe use of AI tools.
- Identifying sensitive beneficiary information.
- Understanding informed consent.
- Recognizing phishing emails and suspicious links.
- Using strong passwords and multi-factor authentication.
- Understanding data privacy and confidentiality.
- Reporting suspected data breaches.
- Reviewing AI-generated information before using it.
Training should not be limited to IT employees.
Programme managers, fundraising teams, field workers, volunteers, researchers, and administrative staff should also understand their responsibilities.
7. Maintain Human Oversight in Important Decisions
AI can analyse information and suggest possible actions, but it should not have complete control over decisions that affect people’s lives.
For example, an AI system may help an NGO identify households that could require additional financial support.
However, trained employees should review the recommendations, consider individual circumstances, and make the final decision.
People should also have a clear way to question or appeal decisions that affect their access to essential services.
This is especially important when AI systems are used for healthcare, refugee assistance, protection programmes, and emergency aid distribution.
Human oversight helps organizations identify mistakes that automated systems may overlook.
8. Conduct Data Protection and AI Impact Assessments
Before introducing an AI system, NGOs should evaluate how it could affect the people whose information will be processed.
This involves understanding what data the system needs, how it will be used, who will have access, and what could go wrong.
For example, before introducing an AI system to prioritize emergency assistance, an NGO should consider:
- Could the system exclude certain communities?
- Does it use sensitive personal information?
- Could someone be identified through the information being analysed?
- Can people challenge incorrect decisions?
- Is the technology provider reliable?
- What happens if the system becomes unavailable?
- Could the system expose individuals to additional risks?
This assessment should happen before the system is introduced, not only after problems occur.
For higher-risk activities, organizations should involve data protection specialists, safeguarding professionals, programme managers, and community representatives.
9. Establish Strong Data Sharing Agreements
NGOs frequently work with governments, donors, research institutions, technology companies, and other humanitarian organizations.
These partnerships often require information to be shared.
However, organizations should clearly establish what information can be shared, why it is needed, and how it must be protected.
A data-sharing agreement should explain:
- The purpose of sharing information.
- Which information will be transferred.
- Who will be allowed to access it.
- How it will be stored and protected.
- Whether it can be shared with additional organizations.
- How long it can be retained.
- What happens when the agreement ends.
- Who is responsible if information is exposed or misused.
These arrangements are particularly important when information is shared across national borders.
10. Prepare a Data Breach Response Plan
Even organizations with strong security systems can experience cyberattacks or accidental information exposure.
NGOs should therefore prepare a response plan explaining what employees must do if a data breach occurs.
The plan should include procedures for:
- Reporting the incident immediately.
- Restricting unauthorized access.
- Identifying the information affected.
- Assessing the potential harm to individuals.
- Informing relevant authorities and affected people where required.
- Taking steps to prevent further exposure.
- Reviewing what went wrong and improving security.
The response should focus not only on protecting organizational systems but also on supporting the people whose information may have been exposed.
Can AI Actually Help NGOs Improve Data Protection?
Although AI introduces new risks, it can also help organizations strengthen their security practices when used responsibly.
AI-supported cybersecurity tools can analyse unusual system activity, identify suspicious login attempts, and help security teams detect potential threats.
Digital document management systems can help classify sensitive information and restrict access to authorized employees.
AI-assisted analysis can also help organizations identify duplicate records, incomplete entries, and unusual patterns that require further investigation.
For example, an NGO managing several healthcare programmes may use secure analytical tools to identify repeated registration records without unnecessarily exposing individual patient details.
Similarly, an organization managing disaster relief operations may use aggregated information to understand which areas require additional support.
Some practical applications include:
Cybersecurity monitoring: AI-supported security systems can help identify unusual activity and possible threats to organizational networks.
Document classification: Digital systems can help identify confidential files and apply appropriate access restrictions.
Data quality checks: AI can help detect duplicate records, missing information, and inconsistencies in programme databases.
Safer reporting: AI can help prepare summaries using aggregated information rather than individual beneficiary records.
Operational planning: AI can analyse non-identifying programme information to help NGOs understand service gaps and allocate resources.
However, these tools must also be evaluated carefully. AI-powered security systems can make mistakes, generate false alerts, and introduce additional privacy concerns.
They should support trained professionals rather than replace them.
Why Small NGOs Need to Pay Attention to Data Protection
Large humanitarian organizations may have dedicated IT departments, cybersecurity specialists, and formal data protection teams.
Small NGOs often do not have the same resources.
Many grassroots organizations depend on a small number of employees who manage fundraising, programme delivery, communication, reporting, and administration.
They may use free software, personal email accounts, spreadsheets, and online storage platforms to manage their work.
While these tools can be convenient, they may create additional risks if information is not managed properly.
For example, a small NGO working with children may maintain beneficiary records in a shared spreadsheet.
If the file is accessible through an unsecured link, people outside the organization may be able to view sensitive information.
Similarly, a volunteer may download confidential records onto a personal device without understanding the security implications.
These problems are not necessarily caused by a lack of concern. They often arise because smaller organizations have limited budgets, technical knowledge, and staff capacity.
However, data protection does not always require expensive technology.
Small NGOs can begin with practical steps:
- Use strong passwords and enable multi-factor authentication.
- Avoid sharing confidential documents through public links.
- Restrict access to beneficiary databases.
- Keep organizational and personal accounts separate.
- Remove former employees and volunteers from organizational systems.
- Avoid uploading identifiable beneficiary information to unapproved AI tools.
- Regularly review where confidential documents are stored.
- Train employees and volunteers in basic digital security.
- Create a simple written AI and data protection policy.
- Maintain secure backups of important organizational information.
NGOs can also seek support from technology partners, digital safety organizations, and professionals who provide cybersecurity guidance to nonprofit organizations.
The most important thing is to build a culture in which protecting people’s information is everyone’s responsibility.
The Role of Donors and Technology Partners in Protecting Humanitarian Data
Data protection should not be the responsibility of NGOs alone.
Donors, technology companies, governments, and other partners also influence how humanitarian information is collected and managed.
For example, donors may require NGOs to provide detailed information about project beneficiaries, programme outcomes, and the use of financial assistance.
While reporting is important for accountability, organizations should avoid collecting unnecessary personal information simply to satisfy reporting requirements.
Donors can support responsible data practices by:
- Encouraging proportionate and secure reporting.
- Avoiding unnecessary requests for identifiable beneficiary information.
- Supporting cybersecurity improvements in funded projects.
- Providing resources for digital safety and staff training.
- Including appropriate data protection requirements in partnership agreements.
Technology companies also have an important responsibility.
AI providers should be transparent about how their systems process information, provide clear privacy controls, and make security protections accessible to nonprofit organizations.
They should also understand that humanitarian organizations may work with people whose personal information could create serious safety risks if exposed.
Responsible technology partnerships should therefore be built around the needs and rights of communities rather than simply the convenience of the organizations purchasing the software.
What Does Responsible AI Look Like in Humanitarian Work?
Responsible AI is not just applying sophisticated tech that is well-intentioned.
It involves making sure the deployment of AI systems considers human rights, privacy, non-discrimination and accountability.
This is a big change for humanitarian organizations.
Instead of merely inquiring about whether a new artificial intelligence tool will enable a task to be completed more quickly, companies need to ask: “Is it needed? Could it hurt someone? Is there a less dangerous way to accomplish this?”
For example:
AI for beneficiary screening, NGOs should ask whether automated decision-making could exclude individuals with incomplete files.
An organisation that employs AI in regard to refugee registration must evaluate if the gathering of further personal details is needed.
I may use AIs to help me analyse feedback about my community, but I should respect the local culture and language.
An NGO who works with survivors of violence might have to question if it is suitable to put case data into an external AI platform when it is extremely sensitive.
They enable organizations to make informed decisions prior to implementing new technology into gender-sensitive programmes.
Responsible AI also requires accountability.
Where an AI model provides a false recommendation or leaks sensitive data, companies should have well-defined processes in place for analyzing the issue and resolving it.
Most importantly, the human element needs to be remembered.
The Future of AI in Humanitarian Work Must Be Built on Trust
AI can accelerate the pace of humanitarian work, help us do it more systematically, and make our efforts more effective.
It is useful for NGOs to analyze needs of their community, preparing reports, preparing emergency plans, using available resources effectively, early detection of service gaps.
These benefits can be of very real value to organizations operating in times of financial and operational constraint.
But never at the expense of people’s safety and privacy.
World Food Programme and ICRC events show that an organization’s internal processes can have impacts well beyond the enterprise. The Rohingya refugee information highlights how sharing data – even through sanctioned channels – can be risky.
The perils of AI expansion for humanitarian groups include not just potential reliance on technology but also organizational, personnel, partnership, and accountability decisions and behaviours.
NGOs can’t afford to dismiss artificial intelligence. They simply need to learn its limits, select the right tools, keep their data secure, and make sure critical decisions are accountable to people.
Aiming for the smallest and simplest and most transparent AI solution, they need to learn that not every aid task requires AI. At times, it is safer to ask for less information, deploy a simpler system or entrust a trained employee to decide.
The real measure of successful AI adoption in the humanitarian sector should not be how much information an organization can process or how quickly it can complete its work. It should be whether technology helps organizations support communities without putting the people they serve at greater risk.
After all, humanitarian work begins with helping people. Protecting their information, dignity, and safety must remain part of that responsibility.
