Learn AI /Responsible AI, Human Rights and Safety /Data security
Data security
- Starter
- Responsible AI, Human Rights and Safety
- Policy officers
Also called: information security, infosec.
Back to the milestone you came from
In five seconds
What it is
Data security means protecting digital or paper information from unauthorised access, change, loss or theft throughout its use, storage and sharing.
In plain words
Data security means putting protections around information so authorised people can use it, while preventing unauthorised access or changes and reducing accidental loss.
An everyday example
A city office keeps land records in a room with a strong door. Only staff with the right badge can enter, some drawers are limited to senior staff, and a clerk writes down who opened which cabinet. Important files are stored in sealed folders, and scanned copies are kept in another building in case of fire or flooding. If a page is found with unexplained changes, staff compare it with the logged copy and restore the correct version.
A records room is physical and easier to picture, but digital data can be copied very quickly, moved across borders in seconds and exposed through software mistakes without anyone opening a visible door. Also, encryption is not literally a sealed folder: authorised systems can automatically unlock data under certain conditions, which adds both usefulness and risk.
Remember thisData security keeps information confidential, accurate and available through access controls, encryption, logging, backups and a clear response when something goes wrong.
Understand it
Understand it
Why it matters
Poor data security can harm people, damage trust and disrupt decisions. If information is stolen, changed or lost, staff may act on false records, expose sensitive details or fail to deliver services. For policy and operational work, this affects accountability: who had access, what changed, and whether the organisation can show it handled information responsibly. Good data security does not guarantee that a project is ethical or lawful, but without it, even a well-meant project can create avoidable risks for rights, safety and reliability.
How data security protects information through its lifecycle
After viewing this diagram, a reader should be able to explain that data security protects information at storage, access, sharing and recovery stages, not just at login.
01
1. Store
Data starts in a file, database or document store. Risk: theft, device loss or unauthorised copying. Protection: encryption and secure storage.
Draw a document and database icon on the left. Above them place a shield labelled 'encryption'. Below place a warning icon labelled 'loss or theft'.
02
2. Control access
Before someone opens or edits data, the system checks identity and permissions. Risk: the wrong person gets in. Protection: accounts, passwords and role-based access control.
Draw user icons moving toward a gate. Show one allowed through with a green role badge and one blocked in red. Label the gate 'access control'.
03
3. Share carefully
When data is sent to another person or system, controls should limit what is exposed. Risk: accidental disclosure or interception. Protection: approved channels, minimum necessary sharing and logging.
Draw an arrow from one box to another. Above the arrow add a lock and a checklist. Below the arrow add an alert icon labelled 'mis-sent or intercepted'.
04
4. Recover and check
If data is deleted, altered or systems fail, backups and audit logs help restore correct information and investigate what happened. Risk: permanent loss or hidden tampering. Protection: backups, version history and monitoring.
Draw a circular arrow from a damaged file icon to a clean restored file. Add small icons for a backup server and an audit log on the right.
A left-to-right flow shows information moving through four stages: stored, accessed, shared and recovered. Each stage has one main risk underneath and one protection above it. Read from left to right to see how safeguards reduce different kinds of harm across the whole lifecycle.
Hover or tap each stage to reveal a short example, such as a lost laptop, a shared spreadsheet sent to the wrong address, or recovery after accidental deletion.
Describe this without the diagram
This diagram explains data security as a four-stage flow. First, information is stored, where encryption and secure storage reduce risks such as theft or loss. Second, people try to access the data, and access control checks who is allowed to view or edit it. Third, data may be shared, so approved channels, limited disclosure and logs reduce the chance of leaks or interception. Fourth, if something goes wrong, backups, version history and monitoring help restore the correct data and detect tampering. The main message is that protection is needed at every stage, not only when users sign in.
With reduced motion: A static four-column diagram replaces animation. Each column shows one stage, one risk and one protection, with arrows fixed from left to right.
Data security is about keeping information safe from the wrong people, the wrong changes and the wrong kinds of loss. The information could be text, images, spreadsheets, audio, paper records or database entries. The aim is to make sure data stays available to authorised people, stays accurate and does not leak.
What goes in is the data itself and the systems around it: devices, accounts, cloud services, files, networks and storage. What happens is a set of protections such as passwords, access control, encryption and backups. Access control means deciding who can open, edit, copy or send something. Encryption means turning readable data into coded text so it is harder to use if stolen.
What comes out should be safer handling of information. The right people can still do their work, but others are blocked. If a device fails or a file is deleted, backups can help recover it. If someone tries to tamper with data, logs and checks can help detect it.
Data security is often confused with privacy, but they are not the same. Privacy is about whether data should be collected, used or shared in the first place and under what rules. Data security is about how that data is protected once it exists. It is also different from AI security, which focuses more specifically on attacks involving AI systems, models or their behaviour.
How “A records room with locks, labels and spare copies” maps onto the real thing
| In the story | In the AI system |
|---|---|
| staff badges and restricted drawers | access control and different permission levels |
| sealed folders | encryption or protected storage |
| log of who opened which cabinet | audit logs and monitoring |
| scanned copies in another building | backups and recovery copies |
| comparing a changed page with the logged copy | integrity checks and restoration |
A worked example
An information management officer in a regional hub is assembling a monitoring report from implementing-partner returns for clearance at close of business.
Starting from: Partner submissions, the reporting template, an approved shared workspace and the current staff access list.
- The officer stores submissions in the approved workspace and grants access only to colleagues assigned to the reporting file.
- Editing rights are limited to the drafting group, while reviewers receive read-only access. Version history and logs make unauthorised or accidental changes detectable.
- Files are encrypted during transfer and while stored. Scheduled backups allow the previous version to be restored if material is deleted or corrupted.
- When a former project colleague still appears on the access list, the officer removes the account, checks the logs and reports the access-control issue through the established incident procedure.
Result: The reporting file remains available to authorised colleagues, improper changes can be traced, and the office can recover the material without circulating duplicate copies through email.
In a United Nations workplace
A humanitarian affairs officer supporting a documentation and library service is finalising terms of reference for digitising an archive, with clearance due before Friday.
The terms of reference need to specify who may access source files and scans, how files are encrypted during transfer and storage, how changes are logged, and how backups, recovery and secure deletion will be handled. Otherwise, “digitise the archive” leaves most of the security work conveniently undefined.
Before you try thisRestricted archive material must not be uploaded to an unapproved AI service, shared with prospective vendors or used as sample data outside approved systems. Use cleared or properly redacted samples, apply the office’s access rules, and ensure the terms of reference require incident reporting and secure return or deletion of data.
Where you may hear it
- A vendor demo during a procurement meeting
- Clearance of terms of reference for a digital archive
- An incident review after an unexpected login alert
- An ICT governance board reviewing access controls
- A handover meeting before a colleague leaves the duty station
Avoid confusion
Avoid confusion
Often confused with
Privacy
Privacy means controlling how information about identifiable people is collected, used, shared and kept, so they are not exposed, tracked or harmed unfairly.
AI security
AI security protects AI systems, their inputs, outputs and connected tools from manipulation, misuse, theft and unauthorised access.
Confidentiality
Confidentiality means limiting access to information so only authorised people can see, use or share it for a legitimate purpose.
Side-by-side
Common misconceptions
Common misconception: If data is encrypted, the security problem is solved.
Correction: Encryption is important, but it protects only part of the chain. Authorised users still need safe accounts and devices, access rights can still be too broad, data can still be mis-sent, and poor backups can still cause loss. Security depends on several controls working together.
Common misconception: Data security and privacy mean the same thing.
Correction: They overlap but ask different questions. Privacy asks whether collecting or using the data is appropriate, lawful and respectful of people’s rights and expectations. Data security asks how the data is protected against loss, misuse or unauthorised access once it exists.
Common misconception: This only matters for highly secret information.
Correction: Even routine information can cause harm if altered, lost or exposed. A public report draft, staff contact list or road-condition dataset may seem low-risk, but errors, tampering or unauthorised access can still delay work, damage trust or create safety issues.
Quick check
Which example best shows data security rather than privacy?
Limiting who can open or edit a folder is a security control called access control. The first option is mainly about privacy and data minimisation. The third is about explainability. The fourth is about fairness.
Go deeper
Go deeper
The simple version
Data security means putting protections around information so authorised people can use it, while preventing unauthorised access or changes and reducing accidental loss.
The technical version
Data security refers to the controls used to preserve the confidentiality, integrity and availability of information across its lifecycle. In practice, this can include identity checks, role-based access control, encryption at rest and in transit, logging, backup and recovery, device security, network protections and procedures for incident response. Confidentiality means preventing unauthorised disclosure. Integrity means preventing or detecting improper alteration. Availability means keeping data accessible to authorised users when needed. In AI-related work, this applies to training data, prompts, outputs, documents and connected systems, but it should not be confused with the distinct topic of AI security, which often focuses on attacks against models or AI-enabled systems.
Reviewed external resources
Primary sourceRecommendation on the Ethics of Artificial Intelligence (opens in a new tab)UNESCO
This link gives a policy-oriented international framework for ethical AI and suits readers who want to place data security within wider governance responsibilities.
Intermediatelink checked 2026-07-31
Primary sourceB-Tech Project (opens in a new tab)UN Human Rights Office (OHCHR)
This link gives a business and human rights perspective on technology use and suits readers interested in human rights risks, responsibility and due diligence.
Intermediatelink checked 2026-07-31
EncyclopaediaData security (opens in a new tab)Wikipedia
This link gives a broad introductory overview of data security and suits readers who want a quick starting definition and common terms.
Intermediatelink checked 2026-07-31
VideoVideo explanations: Data security (opens in a new tab)YouTube search
This link gives a search results page of video explanations on data security and suits readers who prefer to compare several visual or spoken introductions.
search results, not one pagelink checked 2026-07-31
DiscussionCommunity discussion: Data security (opens in a new tab)Reddit search
This link gives a search results page of community discussions on data security and suits readers who want informal questions, examples and differing viewpoints.
search results, not one pagelink checked 2026-07-31
Where this came from
Drafted with a language model through an offline pipeline, checked against this site's schema, and every external link above fetched to see whether it answers. Treat it as a starting point and check anything that matters against the primary sources. How this site is built and what that means.
The one thing to remember
Data security keeps information confidential, accurate and available through access controls, encryption, logging, backups and a clear response when something goes wrong.