Learn AI /Responsible AI, Human Rights and Safety /Confidentiality
Confidentiality
- Starter
- Responsible AI, Human Rights and Safety
- Human rights practitioners
- Programme & data teams
Also called: sensitive information.
Back to the milestone you came from
In five seconds
What it is
Confidentiality means limiting access to information so only authorised people can see, use or share it for a legitimate purpose.
In plain words
Keep sensitive information only with the people who truly need it, and do not put it into tools or channels that are not approved.
An everyday example
At a food distribution point, a coordinator writes tomorrow’s delivery plan. One page lists general stock numbers for all volunteers. A second page contains the names and phone numbers of two drivers and the exact time a high-value shipment will arrive. That second page goes into a sealed envelope addressed only to the transport lead, while the general stock page goes on the notice board. The work continues, but only the people who need the sensitive page can open it.
Real confidentiality is not only about putting something in a hidden place. It also includes rules about collection, copying, onward sharing, retention, logging, and disposal. In digital systems, a person might access data without physically opening anything, and confidential information can sometimes be inferred from small clues spread across several documents.
Remember thisConfidential information may be used only by authorised people, for an authorised purpose and in an approved environment. With AI, minimise the input and check access, retention, logs and onward sharing.
Understand it
Understand it
Why it matters
Confidentiality protects people, operations, trust, and fairness. If sensitive information is exposed, people can be harmed, negotiations can be affected, security can be weakened, and organisations can lose credibility. In AI-related work, mistakes can spread quickly because tools make copying, summarising, and sharing very easy. For a non-specialist, the key decision is simple: before using or sharing information, ask who needs it, what can be removed, which tool is approved, and whether the output reveals more than it should. Confidentiality is not only a legal or technical issue; it is a practical check on responsible judgement.
How confidential information should move through an AI-related task
Show how information should be checked, limited, handled, and shared so sensitive details do not spread beyond authorised users.
01
1. Identify
Check whether the material includes personal, protection-sensitive, legal, medical, financial, security, or other restricted information.
Draw a document icon with highlighted lines and small tags reading personal, legal, security.
02
2. Limit access
Decide who genuinely needs the information for the task. Others should not receive it.
Show three person icons; only one is linked to the document with a solid line, the others with faded lines.
03
3. Use approved handling
If AI is used, use only approved tools and remove or mask unnecessary sensitive details where possible.
Show the document moving into a checked box labelled approved tool; redacted black bars cover some text.
04
4. Share minimum output
Release only the result needed for the job, not the full sensitive source material.
Show a short summary card leaving the approved tool, while the original full document stays behind a lock icon.
A left-to-right step diagram with four boxes connected by arrows. Each box shows one stage in handling information before, during, and after AI use. Read from identifying sensitive content to limiting access, using approved tools, and sharing only the minimum necessary result.
Hover or tap each step to reveal an example of what should and should not be shared at that stage.
Describe this without the diagram
This diagram explains confidentiality as a four-step process. Step 1: identify whether information is sensitive, such as personal, legal, medical, financial, or security-related details. Step 2: limit access to people with a real need to know. Step 3: if AI is used, use only approved tools and remove unnecessary sensitive details where possible. Step 4: share only the minimum result needed, not the full original material. The main message is that confidentiality is maintained by checking the information, restricting who can access it, handling it through approved channels, and avoiding oversharing.
With reduced motion: A static four-step horizontal diagram with labelled boxes and arrows. No animation. Each step remains visible at once, showing identify, limit access, use approved handling, and share minimum output.
Some information should not be openly shared. That can include personal details, health records, legal files, security plans, interview notes, or draft decisions. Confidentiality is the rule and practice of keeping that information restricted to the right people for the right reason.
What goes in is information that could cause harm, unfairness, loss of trust, or safety risks if exposed. Then people and systems apply controls such as access limits, need-to-know rules, careful storage, and safe sharing procedures. What comes out should be useful work without unnecessary exposure of the information.
In AI work, confidentiality matters at every stage: collecting data, preparing prompts, training or testing systems, storing outputs, and sharing results. If staff paste sensitive material into an unapproved public AI service, they may lose control over who can access it or how it is used. Even a summary can break confidentiality if it reveals protected facts.
Confidentiality is often confused with privacy and data security, but they are not the same. Privacy is about a person’s rights and appropriate use of information about them. Data security is about protecting information from loss, theft, or unauthorised access. Confidentiality is the rule that some information must only be available to authorised people, even if the system is technically secure.
How “A sealed envelope for the right desk” maps onto the real thing
| In the story | In the AI system |
|---|---|
| The sealed envelope | Restricting access to sensitive information |
| The transport lead named on the envelope | Authorised person with a legitimate need to know |
| The public stock page on the notice board | Information that can be shared more widely |
| Keeping the two pages separate | Separating confidential data from general operational data |
A worked example
A Headquarters desk officer is consolidating talking points for a meeting in the margins of a session. Contributions have arrived with different access restrictions, and the draft must enter front-office clearance that afternoon.
Starting from: The source file combines language cleared for wider internal use, restricted negotiating positions, drafting comments and contact details for contributing officers.
- The desk officer checks the handling restrictions on each contribution rather than treating the combined file as having one access level.
- Before using AI, the officer confirms that the approved environment may process the relevant classification and that access is limited to the assigned drafting group. If either condition is not met, the material is not submitted.
- Names, contact details, drafting comments and passages unnecessary for the task are removed. Only the minimum authorised text is provided, with instructions to reorganise it without adding or inferring positions.
- The officer reviews the output, prompt history, sharing permissions and exported file before routing the talking points through clearance.
Result: The file sent for clearance contains the authorised substance in the requested structure, without contact details, drafting comments or restricted passages being disclosed to unauthorised users or systems.
In a United Nations workplace
A legal officer at a field presence with an unreliable connection is finalising an aide-memoire for a visiting delegation. Headquarters clearance is due by close of business, but the shared drive keeps dropping out.
The working file contains internal legal advice, non-public comments from counterparts and drafting history. Confidentiality still governs who may access the material, for what purpose and in which processing environment, even when the connection makes approved systems inconvenient.
Before you try thisThe officer must not move the file to a personal account, an unapproved AI service or an unsecured local copy to meet the deadline. Doing so could expose restricted legal advice and third-party comments. Any AI use must occur in an environment approved for that information, with access limited to authorised colleagues and temporary files handled under the applicable retention rules.
Where you may hear it
- A front-office clearance of an aide-memoire before close of business
- A vendor demo where the procurement unit asks what the tool stores and retains
- An inter-agency working group reviewing access to a shared case-management platform
- A records review before documents are circulated outside the office
- An AI pilot review by an ICT governance board
Avoid confusion
Avoid confusion
Often confused with
Privacy
Privacy means controlling how information about identifiable people is collected, used, shared and kept, so they are not exposed, tracked or harmed unfairly.
Data security
Data security means protecting digital or paper information from unauthorised access, change, loss or theft throughout its use, storage and sharing.
Consent
A person freely agrees to a specific use of them or their information after getting clear, relevant information and a real chance to say yes or no.
Side-by-side
Common misconceptions
Common misconception: If information is stored in a password-protected system, confidentiality is fully solved.
Correction: A password helps, but confidentiality also depends on who is allowed to access the information, whether they have a legitimate purpose, what they copy or share, and whether the information is minimised. A secure system can still be used in a way that exposes confidential material to the wrong people.
Common misconception: Removing names always makes information safe to share.
Correction: Names are only one identifier. A person or place can still be recognised from job title, location, dates, rare events, phone numbers, or combinations of details. Confidentiality may still be broken if a summary or dataset allows someone to infer who is involved.
Common misconception: Confidentiality is the same as privacy.
Correction: They are related but different. Privacy concerns people’s rights and appropriate handling of information about them. Confidentiality is a restriction on who may access or share certain information. Some confidential information is not personal, such as internal bidding strategies or security layouts.
Quick check
Which action best protects confidentiality in an AI-related task?
The best answer uses an approved tool and removes details the task does not need. Approval alone does not justify including extra sensitive material. Removing names may leave other identifiers and does not make an unapproved tool acceptable. Human review must check all remaining details.
Go deeper
Go deeper
The simple version
Keep sensitive information only with the people who truly need it, and do not put it into tools or channels that are not approved.
The technical version
Confidentiality is an information-governance principle and control objective that restricts access, use, disclosure, and onward transfer of protected information to authorised parties for specified purposes. In practice it is maintained through classification, need-to-know access, role-based permissions, contractual and professional duties, approved processing environments, minimisation, redaction, logging, retention limits, and review before disclosure. In AI workflows, confidentiality risk can arise during data collection, prompt entry, model training or fine-tuning, retrieval from connected sources, output generation, storage, human review, and sharing. The concept overlaps with privacy and security but is not identical to either: privacy focuses on rights and appropriate processing of personal data, while security covers safeguards against unauthorised access, alteration, or loss. Confidentiality specifically concerns whether information is exposed beyond those authorised to receive it.
Reviewed external resources
Primary sourceRecommendation on the Ethics of Artificial Intelligence (opens in a new tab)UNESCO
This UNESCO recommendation gives a high-level official ethics framework for AI and suits readers looking for policy-oriented guidance.
Intermediatelink checked 2026-07-31
Primary sourceB-Tech Project (opens in a new tab)UN Human Rights Office (OHCHR)
This OHCHR B-Tech material helps readers connect business technology practice with human rights responsibilities and suits programme, policy, and risk-focused audiences.
Intermediatelink checked 2026-07-31
EncyclopaediaConfidentiality (opens in a new tab)Wikipedia
This Wikipedia link gives a broad introductory overview of confidentiality and suits readers who want a quick starting point.
Intermediatelink checked 2026-07-31
VideoVideo explanations: Confidentiality (opens in a new tab)YouTube search
This YouTube search results page helps readers find video explanations from different creators and suits people who prefer to compare several visual introductions rather than read one text.
search results, not one pagelink checked 2026-07-31
DiscussionCommunity discussion: Confidentiality (opens in a new tab)Reddit search
This Reddit search results page lets readers see community questions and discussions about confidentiality and suits readers who want informal examples and common points of confusion, with careful fact-checking.
search results, not one pagelink checked 2026-07-31
Where this came from
Drafted with a language model through an offline pipeline, checked against this site's schema, and every external link above fetched to see whether it answers. Treat it as a starting point and check anything that matters against the primary sources. How this site is built and what that means.
The one thing to remember
Confidential information may be used only by authorised people, for an authorised purpose and in an approved environment. With AI, minimise the input and check access, retention, logs and onward sharing.