Protecting the personal data your NGO holds.

Assessments, policies, security reviews and staff training for organisations that hold personal data, under the GDPR.

Assessments, rules and training for personal data.

Data protection assessments

Self-assessment workshops and their analysis, a review of your current policies, and a risk assessment.

We start with self-assessment workshops where your teams describe how they collect, store and share personal data. We analyse what they show, review the policies you have and assess the risks, so you know where to act first.

What you get

• Self-assessment workshops with your teams
• A report of the findings
• A review of your current policies
• A risk assessment, ranked

Tools and methods

GDPR, Swiss FADP, POPIA

Where we have done it

• Diakonie Katastrophenhilfe: Self-assessment workshops analysed and reported, then data protection guidelines drafted for the whole organisation.
• Cáritas Switzerland: Recommendations on data safety and security, compliant with the GDPR, alongside advice on information tools.

Policies and procedures

Data protection policies and step-by-step procedures, aligned with the GDPR, with room to adapt to each country’s law.

A policy only works if staff can apply it. We turn your principles into step-by-step procedures with clear roles, short enough to read, aligned with the GDPR and with room for each country’s law.

What you get

• Policies aligned with the GDPR
• Step-by-step procedures, roles and duties
• A directive short enough to apply, plus annexes
• A short summary for staff

Tools and methods

GDPR, Swiss FADP, Inter-agency protocols

Where we have done it

• Terre des hommes: A directive of ten pages at most for child protection case management, adaptable to over 30 countries’ laws.
• Diakonie Katastrophenhilfe: Data protection guidelines for the whole organisation, with next steps for each level and local partners.

Risk and breach planning

Risk assessments, mitigation plans, data breach responses and password policies.

We list the ways personal data could be lost, exposed or misused, rank each risk and write the plan to bring it down. A breach response sets out who does what in the first hours, written before it is needed.

What you get

• Risk assessments
• Mitigation plans
• Data breach responses
• A stronger password policy

Tools and methods

GDPR, POPIA

Where we have done it

• ITPC: A guide with risk assessments, mitigation plans, breach responses and improved password policies, for a global network.

Security reviews

Access rights, accounts and backups checked, ranked by risk and fixed with your IT team.

We check who can open what: accounts, access rights, roles, backups and where the data is hosted. Findings are ranked by risk, and we fix them with your IT team or our developers.

What you get

• A review of accounts, rights and roles
• Backups and hosting checked
• Findings ranked by risk
• Fixes, with your IT team or ours

Where we have done it

• UNICEF Mexico: An admin tool where access is set by role and by action: create, update or delete.
• Reporters Without Borders: Journalists in war zones kept anonymous, with transactions made through unique tokens.

System and hosting security

We host your systems securely, or secure your own servers with your IT team.

We host your systems under our information security policy, or secure your own servers with your IT team. That means multi-factor sign-in, access by role, encryption in transit and at rest, and test copies that never hold real names.

What you get

• Data stored in the EEA first
• Multi-factor sign-in and access by role
• Encryption in transit and at rest
• Restore tests every year

Tools and methods

Aligned with ISO/IEC 27001:2022, GDPR Article 28

Where we have done it

• GIZ: A platform moved to GDPR-compliant European hosting, with separate automated backups of the database and files.
• ILO: Role-based access and Azure AD sign-in, with permissions set for each country.

Staff training

Workshops on handling data safely and preventing security incidents, for HR and regional offices.

Staff are the first line of protection. Our workshops show HR, programme and regional teams how to handle personal data safely every day and prevent security incidents, using your own guidelines.

What you get

• Workshops for HR, programme and regional teams
• Practical tools to apply the guidelines
• Next steps for each level and local partners

Where we have done it

• ITPC: Trainings for staff across the network on processing data safely and preventing security issues.
• Diakonie Katastrophenhilfe: Guidelines rolled out in workshops at HR and regional office level, with next steps for local partners.

Data protection for social impact organisations.

• DP4G
• One-off audits

Data protection work we have done.

• Terre des hommes: A directive of 10 pages at most, with a summary in English and French.
• ITPC: A guide with risk assessments, mitigation plans and data breach responses.
• Diakonie Katastrophenhilfe: Data protection guidelines, rolled out in workshops at HR and regional offices.

In their words

This has been a very important step for us as an organization towards data protection at all levels and the outputs provided staff with concrete guidelines and tools to apply the theory into practice on the ground.

See the project

Rules short enough to apply, wherever your teams are.

Policies: One directive, adaptable to over 30 countries.

For Terre des hommes: a child protection data directive of ten pages at most, plus annexes, that each country can adapt to its own law.

• Aligned with the GDPR and Swiss FADP
• Step-by-step procedures, roles and responsibilities
• Short enough for protection teams to apply

Risk: Each risk ranked, then brought down.

Risk assessments and mitigation plans, with the findings ranked by risk and fixed with your IT team.

Breach response: A plan for the first 72 hours.

Breach responses written before they are needed. Under the GDPR, a breach that puts people at risk goes to the authority within 72 hours.

Several laws: Written for the GDPR and POPIA.

A data protection guide for ITPC, to the standards of both laws.

Rollout: From head office to local partners.

Diakonie’s guidelines were rolled out in workshops at HR and regional office level, with next steps for local partners.

Access: Access by role and by action.

Government and NGO teams feed one child protection system, each role allowed to create, update or delete only what it should.

Data protection specialists who know NGOs.

They work with your programme, HR and IT teams, and with our developers when a system has to change.

Raphaël

16 years with UN agencies and NGOs. Responsible data strategy, governance and policy. Executive Master, Innovation Management. Executive Course in AI.

Arturo

20 years with IFRC, WHO, UNESCO, ILO and WFP. GDPR and privacy by design. DPO certification (ECPC-HA). No-Code AI and ML Professional Certificate.

Antoine

6 years with WHO, UNESCO, ILO and RSF. Infrastructure, DevOps and security architecture. Software engineering, École Centrale de Nantes.

Hadrien

6 years in the public sector. GDPR, ISO 27001, NIS 2 and the AI Act. DPO certification (CNIL framework). ISO 27001 Lead Auditor.

How a review runs.

1. Assess: Self-assessment workshops with your teams, then we analyse what they show.
2. Write the rules: Step-by-step procedures, roles and responsibilities, with room for each country’s law.
3. Secure the systems: Access rights, accounts, hosting and backups checked with your IT team or our developers.
4. Train your staff: Workshops at HR and regional office level on applying the guidelines.

Before you get in touch.

How long does a review take?

It depends on the offices, systems and policies to cover. A directive of ten pages at most for child protection case management took one month. Data protection guidelines with rollout workshops at HR and regional office level took four months. After a first call, we send a written proposal with the steps, the timeline and the cost.

Can the workshops run on site?

Yes, or online, as agreed in the proposal. Reviews and drafting run remotely.

Can one policy cover several countries?

Yes. Our directives leave room to adapt to national law; one of them covers more than 30 countries.

Can you help us meet the GDPR?

Yes. We assess your practices against the GDPR, then write the policies and procedures that close the gaps.

Is this linked to Data Protection for Good?

Data Protection for Good (DP4G) is our external data protection officer service. Its own page explains what it includes.

Often combined with.

One team works across all of them.

• Mobile, Web Dev & Maintenance: When a review finds a system to change, our developers fix it with your IT team.
• AI & Interactive Tools: Using AI on personal data? We write the governance and set the limits before anything goes live.
• Capacity Building & Training: A policy works when staff know it. We run the workshops and write the guides that go with it.

Guides: Does an NGO need a DPO? / DPIAs for NGOs

Tell us about your project.

Where you are, what you need and by when. A consultant will write back with questions and next steps.

1. Write to us: Three fields are required. The rest helps us prepare.
2. A consultant replies: By email, at the address you give.
3. We talk it through: A first call about your needs and how we could help.

Prefer email? contact@reliefapplications.org