Donor data and chatbots: closing the control gap
Why staff paste personal data into AI tools, why it matters, and three simple controls that stop it.
Ifedayo · · 2 min read
When people paste donor or client details into an AI tool, it is rarely carelessness. They are trying to save time on a real task: drafting a thank-you letter, cleaning a list, summarising notes. The problem is not the intention. It is that nobody told them where the line is.
Why it matters
Personal data you hold comes with obligations under UK data protection law. Putting it into a tool you have not assessed means you may not know where it is stored, who can see it, or whether it will be used to train the tool. The ICO publishes guidance on AI and data protection that is worth reading in full; the short version is that you need to know what you are doing with personal data and why.
Three controls that close the gap
- A one-line rule. “No personal, donor, client or financial data goes into AI tools unless the tool is on our approved list for that purpose.” Write it down and share it.
- An approved list. Decide which tools are allowed, and check their data settings. Many tools let you switch off training on your data, and some business plans offer stronger terms.
- A safe way to report mistakes. Make it easy and blame-free for people to say “I think I pasted the wrong thing”. Early reporting is what turns an incident into a near miss.
None of these needs a budget. Together they move you from “we hope it is fine” to “we have a rule, and people know it”.
Check your own position
The free AI & Controls Self-Check includes three questions on data protection and gives you specific actions for whatever your score.