What is personal data?
Personal data is any information that can identify a living person, either on its own or when combined with other information. Names, photos, phone numbers, email addresses, ID numbers, GPS locations of a home and case notes are all personal data.
Staff, donors, vendors and volunteers are people too. A payroll file, a board member list and a supplier contact sheet all hold personal data, so your data map must include them and not only program records.
Some personal data is more sensitive. Health details, ethnicity, religion, political views, sexual orientation, and records about abuse or safeguarding need extra care because harm from a leak is greater. Our article on handling sensitive program data goes deeper.
What are the core principles?
Most data protection laws and guidelines rest on similar ideas. Exact wording and duties differ by country, so treat this as a plain-language summary and not as legal advice.
- Purpose: collect data for a stated reason and use it for that reason.
- Minimum: collect only what you need. If you do not use a field, stop asking for it.
- Accuracy: correct wrong data and remove old data.
- Limited access: only people who need the data should see it.
- Limited time: keep data only as long as you need it or must by rule.
- Security: protect data from loss, theft and misuse.
- Fairness and openness: tell people what you do with their data.
Why is consent not enough on its own?
NGOs often work with people who cannot easily say no, because aid depends on giving details. A signature on a form may not be free consent. Explain in plain words, in the person’s language, what you collect, why, who sees it and how long you keep it. Offer a way to ask questions or withdraw where the law allows it. Ask a qualified adviser which legal basis applies to your work.
Pay special attention to children and to people in danger. Ask whether a parent or guardian must agree, and whether the data could put the person at risk if it leaked. When in doubt, collect less.
What is a practical starter checklist?
Do these in order. Each step makes the next one easier.
- Make a data map. List each place you hold personal data: databases, spreadsheets, paper files, phones, email.
- Write the purpose next to each item.
- Remove what you do not need. Delete unused columns and old files.
- Set access. Decide which roles may read, change or export each type of data.
- Set a retention time for each type and a date for review.
- Check your suppliers. Know which providers process your data, and where. Our article on data processing agreements explains the contract side.
- Train staff in short sessions, and repeat each year.
- Write a breach plan. Say who to tell, how fast and what to record.
How do you handle requests from people?
In many countries, people may ask to see their data, correct it or ask for its deletion. Prepare a simple routine:
- one named person receives the request,
- the person’s identity is checked before anything is shared,
- the answer is sent within the time your law sets,
- the request and the answer are recorded.
Practice once with a test request so the routine works under pressure. Keep a simple log with the date received, the date answered and the outcome. The log is also useful evidence for a donor review or an audit, because it shows the routine works.
Do not forget paper. Files in cabinets, printed lists and notebooks in field vehicles hold personal data too. Lock them, limit who has keys, and shred them when the retention time ends.
What should you do if data is lost or leaked?
Act fast and keep a written record.
- Contain it: disable the account, remove the exposed file or change the password.
- Find out what happened: which data, how many people, since when.
- Tell the right people: your leadership first. Then check whether the law, your donors or the people affected must be told, and by when.
- Fix the cause and write down what you changed.
A short written plan made in calm times saves hours on a bad day. Test it once a year with a short drill: pick a scenario such as a lost laptop, and walk through who does what.
Where EMPOBase fits
EMPOBase supports several of these basics. You can control access with roles, remove people’s access when they leave, and review selected activity records. EMPOBase is hosted on Google Cloud in the Singapore region, uses HTTPS/TLS and Google-managed encryption at rest, and does not sell customer data. A Data Processing Agreement is available on request. The software does not decide your legal duties or retention periods; you set those with your adviser. See the privacy page and the security page.