Relief Applications

Humanitarian case management systems: how to choose one

A case management system holds the most sensitive records an NGO keeps: who a person is, what happened to them and who is helping. Choosing one is a protection decision as much as a technical one. This guide covers what case management is, what a system has to do, who should see what, the options, and the data protection work to finish before you go live.

The short answer

A humanitarian case management system records each person’s case from intake through assessment, a support plan, referrals and follow-up to closure, and restricts every file to the people who need it. Choose it on confidentiality first: consent recorded, role-based access, an access log, offline capture and safe referral between organisations. Because the records concern vulnerable people and sensitive data, plan a data protection impact assessment before you go live.

What case management is

Case management is a way of working before it is software. A caseworker accompanies an individual or a family: understands their situation, agrees a plan with them, arranges services, follows up and closes the case when the need is met or the person leaves. It is used in child protection, gender-based violence (GBV) response, protection of other at-risk groups, and health and social support.

The inter-agency guidelines for child protection and for GBV case management describe the steps in similar terms. In practice:

  1. Intake and registration, with the person’s informed consent or, for a child, assent and the consent of a caregiver where appropriate.
  2. Assessment of needs and risks.
  3. A case plan with actions, owners and dates, agreed with the person.
  4. Implementation, including referrals to services.
  5. Follow-up and review.
  6. Closure, with the outcome recorded.

A system should support that sequence and protect the information in it. It should not shape the work around its own screens.

The principles a system has to respect

  • The person’s safety and best interests come first, and in GBV work the survivor chooses what happens to their information.
  • Informed consent, or assent for children, is recorded for the case and for each time information is shared with another organisation.
  • Confidentiality: information is shared only with those who need it to help the person, and only what they need.
  • Need to know: a caseworker sees their own cases, a supervisor their team’s, a manager statistics.
  • Non-discrimination: the system should not make it harder for any group to be registered or helped.

If a system cannot enforce these, no amount of staff training will make up for it.

What a system must do

A case register with statuses
Everyone can see what is open, active, referred or closed, without opening files they should not
Intake and assessment forms you can configure per programme
Child protection, GBV and health use different questions, and you should not need a developer to change them
Consent recorded for the case and for each disclosure
It is the legal and ethical basis of everything after it
Service plans with tasks, owners and risk levels
Cases move forward because someone is responsible for the next step
Referrals, tracked until accepted
Referrals get lost between organisations; a tracked one is followed up
Follow-up calendar and reminders
Visits are not missed when staff change
Role-based access with an access log
You must be able to show who opened which file, and limit it to those who need it
Offline capture on phones and tablets
Much case work happens where there is no connection
Anonymised statistics for reporting
Donors and coordination groups need numbers, not identities
Retention rules and secure deletion
Records should not outlive their purpose
Export in an open format
You must be able to move on, and to hand records to the organisation that takes over

Who should see what

Settle access before you configure anything. A starting point to adapt:

Caseworker
Sees: Their own cases in full. Does not see: Other caseworkers’ cases
Supervisor
Sees: Cases of their team, to review and advise. Does not see: Other teams’ cases
Programme manager
Sees: Anonymised statistics, trends, workload. Does not see: Names and case notes
MEAL and donor reporting
Sees: Aggregated, anonymised figures. Does not see: Any identifying detail
IT administrator
Sees: System settings, backups. Does not see: Case content, by design
Finance and HR
Sees: Nothing from case files. Does not see: All of it

The last two lines surprise people. Administrators and managers often have access to everything by default, and that default is the thing to change.

Your options

Paper files and spreadsheets
Fits: Very small, short programmes. Watch for: Files get lost, anyone with the spreadsheet sees everything, and nothing is logged
An inter-agency platform, such as Primero, an open-source case management platform supported by UNICEF, for child protection and gender-based violence case management and incident monitoring
Fits: Organisations working within child protection or GBV coordination, which may already use it. Watch for: Hosting and set-up fall to you or a partner; fit with the rest of your systems
A configurable platform you adapt yourself
Fits: Organisations with a technical team and uncommon workflows. Watch for: Security, hosting and long-term maintenance are your responsibility
A custom build
Fits: Needs no product covers. Watch for: The full cost of maintenance falls on you; plan support from day one
A case management module in a wider ERP
Fits: Organisations that want cases linked to programmes, referrals and reporting on one base. Watch for: Whether it goes as deep as a specialist platform for your caseload

Ask whether your coordination group or donor already uses a platform. Sharing the same system, with proper agreements, can make referrals easier.

Referrals and information sharing

Referral is where protection can fail. Agree an information-sharing protocol with the organisations you refer to before the first case: who may receive what, with whose consent, how it is sent and how long they keep it. Record the person’s consent for each referral, share only what the receiving service needs, and track the referral until the service confirms it has accepted. A system that stores a partner directory and referral pathways, and follows each referral to acceptance, saves cases from falling between organisations.

Data protection

Case files combine vulnerable people with sensitive data, which is why a data protection impact assessment is nearly always needed before you start. Decide at the same time:

  • The legal basis for each use of the data, and how it fits with consent in your context.
  • Where the system is hosted, who can reach it and under what agreement with the provider.
  • How long you keep closed cases, and how deletion is done and checked.
  • What happens in a breach, and who tells the person.
  • What happens if you have to evacuate or close the programme.

Read our guide to DPIAs for NGOs, which includes a template, and does an NGO need a DPO? if your organisation has not yet settled who advises on it. We also worked with Terre des hommes on a global directive for data protection in child protection case management.

Rolling it out

  1. Agree the workflow and the access rules on paper first, with caseworkers and supervisors.
  2. Configure forms for one programme and test with real scenarios, not made-up cases.
  3. Move paper and spreadsheet records carefully, and destroy the originals once checked.
  4. Train caseworkers and supervisors together, with practice on consent and on referrals.
  5. Check the access log regularly in the first months.
  6. Add programmes one at a time.

Where Relief One fits

Relief One’s Case Management module gives each organisation a case register, intake and assessment forms configured per programme (offline if needed), service plans with owners and risk levels, referrals followed until accepted, and a follow-up calendar. Cases are confidential and visible to named people, and the module reports anonymised statistics for donors. Related modules, such as Safeguarding and Complaints, sit on the same base.

Case management also covers uses beyond protection. For Expertise France, we built a case management platform for the Tess Mav+ project, where partner countries submit requests that the team validates and assigns to experts, with role-based permissions.

Questions and answers

What is a humanitarian case management system?

Software that records and tracks each person’s case, from intake and assessment through a support plan, referrals and follow-up to closure, with access limited to the people who need each file. Organisations also call this a beneficiary management system.

What is the difference between case management and a beneficiary database?

A beneficiary database records who received what. Case management records a person’s situation and the support given over time, with a plan, referrals and follow-up, and is usually far more sensitive.

Do we need consent to record a case?

You need a clear legal basis and, in protection work, the person’s informed consent or a child’s assent is normally recorded, for the case and for each time information is shared. Say how you handle people who cannot give it.

Can we use a spreadsheet or a form tool for case management?

For a very small programme, with care. Spreadsheets give no per-file access control and no log, so they stop being acceptable as soon as the cases are sensitive or several people have the file.

Do we need a DPIA?

Almost certainly. The data concerns vulnerable people and is sensitive, which are two of the criteria that point to a DPIA. Do it before the system goes live.

Should donors see case data?

No. Report anonymised, aggregated statistics. Donors need to see that cases are handled well, not who the people are.

See a confidential case from intake to closure

Book a demo of Relief One. We show a case register, a referral followed until accepted, and who can see which file.

Keep reading

This guide is general information, not legal or technical advice. Reviewed on 11 November 2026 by the team at Relief Applications.