Protecting data: what you never give an AI, and how to anonymise

1Why this is the most important week

Humanitarian organisations hold some of the most sensitive data there is: identities of refugees or displaced people, survivors of violence, separated children, health data, team locations, security incidents, information about armed groups. A leak can expose people to reprisals, discrimination or violence.

When you paste text into an AI assistant, that text leaves your computer and is processed on the provider's servers, often in another country. Depending on the plan and settings, it may be retained, sometimes read by people in charge of quality, or used to improve the models.

Principle: never give an AI assistant data that you would not be allowed to email to an external contractor without a data processing agreement.

2The reference principles

The Handbook on Data Protection in Humanitarian Action by the ICRC and the Brussels Privacy Hub (2nd edition, 2020, which also covers new technologies), the data protection policies of UN agencies and, for the organisations concerned, the European Union's General Data Protection Regulation (GDPR) set out common principles:

• lawfulness and purpose: data is collected for a specific purpose and is not reused for an incompatible purpose;
• minimisation: use only the data strictly necessary;
• security: protect data against unauthorised access;
• transfers: regulate any transfer to a third party or another country;
• rights of individuals: information, access, rectification.

Giving the data of a beneficiary list to an AI assistant for the general public is a transfer to a third party, for a purpose that was not announced to the people concerned. In the vast majority of cases, this is contrary to these principles.

The sector also speaks of demographically identifiable data: even without names, aggregated data (for example the precise location of an ethnic or religious minority group) can expose an entire community.

3What you never give a consumer assistant

• Names, phone numbers, card or registration numbers, photos, addresses, GPS coordinates of beneficiaries or staff members.
• Any information about survivors of gender-based violence, children, protection cases, mental health or HIV, even roughly "anonymised".
• Detailed security incident reports, routes, positions and travel times, evacuation plans, information on access negotiations.
• Allegations of sexual exploitation and abuse, fraud or corruption under investigation.
• Individual health data.
• Passwords, access keys, bank details.
• Documents marked confidential by the organisation, a donor or a partner.

For these categories, even a professional plan with contractual commitments is not always enough: a documented decision by the organisation (data protection impact assessment) is required before any use.

4Consumer plans and professional plans

In November 2026, the broad lines are as follows (always check the terms in force):

• Consumer plans (free or individual subscription): both providers offer settings to control history retention and the use of conversations to improve models. At Google, Gemini Apps activity may be retained and conversations may be reviewed by people; a setting allows it to be turned off. At Anthropic, the user chooses in the privacy settings whether their conversations may be used for training, and Claude offers an incognito chat mode.
• Plans for organisations (Claude Team and Enterprise; Gemini in Google Workspace for business and education): providers commit contractually not to use customer data to train their models by default, with central administration, access controls and data processing terms.

In practice:

• a free personal account should only be used for public or non-sensitive information;
• internal (non-sensitive) information belongs in a professional plan approved by the organisation;
• personal and sensitive data remains excluded, unless there is a formal, regulated decision.

Turning off history or training use reduces risks, but does not turn a personal account into an authorised tool for beneficiary data.

5Classify, then anonymise

Before each use, classify the information according to the organisation's policy, for example:

• Public: published reports, calls for proposals, legal texts. Usable with any assistant.
• Internal: draft proposals, procedures, minutes without personal data. Approved professional plan.
• Confidential: detailed budgets, partner assessments, negotiations. Professional plan and manager's approval, after removing unnecessary elements.
• Sensitive: personal data, protection, security, investigations. Excluded.

Anonymising means making it impossible to identify a person, including by cross-referencing. Pseudonymising means replacing identifiers with codes ("Beneficiary A"); the person remains identifiable by whoever holds the lookup table: this is still personal data.

Common traps: a village of 300 inhabitants plus "34-year-old woman, widowed, four children" is enough to identify someone; a focus group quote may contain a name or nickname; file metadata (author, comments, revisions) contain names. Remove unnecessary details, group ages and places, and delete comments and document history.

6Good everyday habits

• Use the account provided by the organisation for work, never a personal account for internal documents.
• Check the privacy settings at first login, then every quarter: history, training use, memory, enabled connectors.
• Limit connectors (access to email, Drive) to what is strictly necessary: an assistant that can read your whole mailbox can also read sensitive data in it.
• Do not share public links to conversations containing internal information.
• In the field, watch out for visible screens and shared devices; log out.
• In case of error (sensitive data pasted by mistake): delete the conversation, then report the incident to the data protection focal point without delay. An error reported quickly limits the damage; a hidden error makes it worse.