The short answer
Security is about keeping data from people who should not have it. Privacy is about whether it should have been collected, kept and used that way at all, including by people who are authorised. A perfectly secured system can still be a privacy failure.
Responsible AI, Human Rights and Safety · Starter
- In one sentence
- Privacy means controlling how information about identifiable people is collected, used, shared and kept, so they are not exposed, tracked or harmed unfairly.
- Why it matters
- Privacy affects safety, dignity, trust and rights. If too much personal data is collected or used carelessly, people can be exposed, tracked, profiled or treated unfairly. In AI systems, privacy problems can spread quickly because data is easy to copy, combine and analyse at scale. For a non-specialist, the key decision question is simple: do we really need this data, for this purpose, in this form, with these people able to access it? If the answer is unclear, the risk is often higher than it first appears.
- The everyday version
- Privacy means using information about people only when needed for a clear purpose, without exposing them through careless or unfair data practices.
- The one thing to remember
- Privacy requires control throughout the data lifecycle. Collect the minimum, use it only for the stated purpose, limit access and sharing, and delete it when it is no longer needed.
- The commonest misconception
- If names are removed, privacy is no longer a concern. Removing names helps, but it may not be enough. People can sometimes be identified from location, age, job title, rare traits or by linking one data set with another. Privacy review should consider re-identification risk, not just obvious identifiers.
Read the full page
Responsible AI, Human Rights and Safety · Starter
- In one sentence
- Data security means protecting digital or paper information from unauthorised access, change, loss or theft throughout its use, storage and sharing.
- Why it matters
- Poor data security can harm people, damage trust and disrupt decisions. If information is stolen, changed or lost, staff may act on false records, expose sensitive details or fail to deliver services. For policy and operational work, this affects accountability: who had access, what changed, and whether the organisation can show it handled information responsibly. Good data security does not guarantee that a project is ethical or lawful, but without it, even a well-meant project can create avoidable risks for rights, safety and reliability.
- The everyday version
- Data security means putting protections around information so authorised people can use it, while preventing unauthorised access or changes and reducing accidental loss.
- The one thing to remember
- Data security keeps information confidential, accurate and available through access controls, encryption, logging, backups and a clear response when something goes wrong.
- The commonest misconception
- If data is encrypted, the security problem is solved. Encryption is important, but it protects only part of the chain. Authorised users still need safe accounts and devices, access rights can still be too broad, data can still be mis-sent, and poor backups can still cause loss. Security depends on several controls working together.
Read the full page
Responsible AI, Human Rights and Safety · Starter
- In one sentence
- Confidentiality means limiting access to information so only authorised people can see, use or share it for a legitimate purpose.
- Why it matters
- Confidentiality protects people, operations, trust, and fairness. If sensitive information is exposed, people can be harmed, negotiations can be affected, security can be weakened, and organisations can lose credibility. In AI-related work, mistakes can spread quickly because tools make copying, summarising, and sharing very easy. For a non-specialist, the key decision is simple: before using or sharing information, ask who needs it, what can be removed, which tool is approved, and whether the output reveals more than it should. Confidentiality is not only a legal or technical issue; it is a practical check on responsible judgement.
- The everyday version
- Keep sensitive information only with the people who truly need it, and do not put it into tools or channels that are not approved.
- The one thing to remember
- Confidential information may be used only by authorised people, for an authorised purpose and in an approved environment. With AI, minimise the input and check access, retention, logs and onward sharing.
- The commonest misconception
- If information is stored in a password-protected system, confidentiality is fully solved. A password helps, but confidentiality also depends on who is allowed to access the information, whether they have a legitimate purpose, what they copy or share, and whether the information is minimised. A secure system can still be used in a way that exposes confidential material to the wrong people.
Read the full page