A community organisation may collect names for a meeting, receive a sensitive account by message and take photographs for an update on the same day. Each task raises a different question about what information is needed and who should see it.
Convenient tools can blur these boundaries. A photograph uploaded for publicity may reveal a person's participation in a sensitive activity. A widely shared spreadsheet may expose more information than its recipients need. A lost device can affect people who trusted the organisation with their details.
Collect less, explain more
Before creating a form, identify its purpose and remove fields that are unnecessary. Tell people how their information will be used and who will receive it. Do not assume that agreeing to attend an activity means agreeing to appear in public communications.
Kenya's Office of the Data Protection Commissioner explains principles including purpose limitation, collecting only necessary data and retaining identifiable information only as long as needed. Its guidance is a stronger starting point than copying another organisation's privacy notice without examining actual practice.
Protect access and plan departures
Use strong, distinct account passwords and multi-factor authentication where available. Limit access to people who need it for their role. When a volunteer leaves, review organisational access promptly and transfer necessary work through an agreed process.
Keep a basic inventory of what is collected, where it is stored and who is responsible. Agree how the team will report a lost device or accidental disclosure internally, then assess the applicable response requirements using official guidance or qualified advice.
Support should include the tools
Funders and partners can budget for appropriate devices, connectivity, secure storage and training. Digital responsibility should not depend on a volunteer quietly paying for the organisation's systems.
Good data practice begins with a simple question: can we achieve this purpose while exposing less information about the people involved?
Official sources: ODPC data-subject rights and data-protection principles and ODPC guidance notes, checked 17 October 2026. These practical steps do not replace assessment of the organisation's specific legal duties.