Other formats: See the video associated with this guide here. Access this guide in PDF here.
Understanding the different classifications of data can be difficult, but they are an important part of working with humanitarian data. For example, what is the difference between personal data and sensitive data? Particular types of data may require special care in accordance with regional or national laws or organizational policies, and can present different types of risk to both program participants and organizations. Sensitive data is a sub-category of personal data and this section provides detailed guidance for processing and understanding it.
A majority of Mercy Corps programs and other activities collect some kind of personal information about individuals. In many cases programs also collect information about an individual's cultural profile, sexual orientation, health, or biometrics and genetics. These types of information are considered sensitive data and if they are disclosed, accessed or shared improperly, could result in:
- harm to a person, such as sanctions, discrimination and security threats;
- a negative impact on Mercy Corps' ability to carry out activities and reduced trust or public perception. It is vital to take the necessary steps to protect these data.
It is vital to take the necessary steps to protect these data.
This section contains two documents:
- "Guidance for processing of sensitive data" introduces you to sensitive data, key terms, and things to consider when planning its collection, storage, analysis, and sharing.
- "Sensitive Information Assessment (SIA) Template" can be used with a Privacy Impact Assessment to document all additional safeguards being employed for sensitive data. This document also sets out the different legal bases that can be used to justify the collection and use of sensitive data.
Planning for the collection or use of sensitive data should be part of a larger strategy for the data life cycle of a program or activity. There are several resources that can help you.
- The International Federation of Red Cross and Red Crescent Societies (IFRC) Data Playbook is an excellent resource of exercises, session plans, checklists, and other materials to help you organize conversations and activities with your team. In particular, Module 4 - Responsible Data is a good place to start.
- The International Committee of the Red Cross' Handbook on Data Protection in Humanitarian Action is a detailed guide to almost every aspect of humanitarian data. Chapter 3 specifically deals with the legal basis for personal data processing.
- The Cash Learning Partnership's Data Responsibility Toolkit is designed for cash and voucher practitioners specifically, but is a "gold standard" in guidance for responsible data. Specifically, Tip Sheet #2, "Design and Plan" discusses lawful basis for sensitive data. The Toolkit is available in English, Arabic, French, and Spanish.