Sensitive data here means information about people the charity supports, donors, volunteers or staff, including health, care, safeguarding and other special category information. The ICO guidance on special category data requires a lawful basis and a separate condition before that information is used. The ICO guidance on AI and data protection expects the same care when an AI tool is the one doing the reading.
A public ChatGPT tab does not give the board that control. Staff should not paste case notes, care records or donor details into it to save time. The Charity Commission note on charities and artificial intelligence is a prompt for trustees to understand the tool they are allowing, not a permission slip for an open chat box.
Before any sensitive record meets an AI tool
- Name the record. Say which information would be used, and whether any of it is special category data.
- Name the place. Write down the system that will hold the prompts and the answers. If the answer is "a public website", stop.
- Name the person. Someone at the charity reads the output before it is relied on, sent, or filed.
- Name the purpose. One job, such as a first draft from an approved extract. Not "see what it says about this family".
- Tell the board. Trustees should be able to explain the choice in ordinary language. The essential trustee guidance keeps that duty with them.
Where the work can sit
A Private AI Workspace runs on the charity's own system. Staff still approve what goes out. For the wider design questions, read Can charities use AI with sensitive data in the UK? If you are choosing a first project that stays away from these records, read How a small charity can start with AI safely and the trustee questions to ask before anyone approves a tool.
Welsh Government's artificial intelligence overview asks public services to keep AI ethical and trustworthy. A charity handling sensitive records can use that as a plain test: if you cannot explain the tool to the people whose information it reads, do not use it on those records.
Questions
Short answers.
Can we paste a case note into public ChatGPT?
No. A public chat is someone else's system. Do not paste beneficiary, donor or staff records into it.
Can a charity use AI on sensitive data at all?
Yes, when the tool, the place the data is processed, and the person who checks the output are agreed first. Special category data needs a lawful basis and a separate condition under UK GDPR.
Where should sensitive work run?
On a system the charity controls, with approved sources and a human review before anything goes out. That is what a Private AI Workspace is for.
Contact us
If staff are already using a public chat on sensitive records, or you want a private place for one agreed job, contact us.
Contact usEmail: hello@aifor.wales
Phone: 07404 692 110