Step 4. Remove personal and sensitive information

All about data protection, being a responsible publisher, and protecting people’s privacy.

Privacy and open data

In general, open data should not contain personal information that could allow a living person to be identified. 360Giving data which relates to specific individuals should be removed or made anonymous to protect their privacy.

Public vs personal information

Information about grants given to individuals may include personal data, such as the name or address of an individual or family that has received a grant, or demographic information, such as an individual’s race or sexual orientation.

Most information about grants awarded to organisations is public rather than personal data. But personal data can sometimes appear in grants given to small organisations and community groups. For example:

• Name, personal phone number or email address of a contact person for a funded group.
• Personal or home address when a project is being run from somebody’s home.

Sensitive information

There are cases where grants data is sensitive for reasons other than privacy. For example, it would be harmful to publish the address of a refuge for people escaping domestic abuse.

Think about whether any of your data might include sensitive details, and make sure you have a process in place to check and remove it, or ask for permission to publish it.

Review your privacy policies and grant agreements

If your organisation announces details of grants through annual reports, online news stories or press releases, you should already have processes in place to make sure you have the right to share this information publicly.

• Check the terms of your grant agreements for any clauses about publicity and sharing information about grants.
• Check if your organisation has a privacy policy or terms and conditions that applicants agree to when they submit a grant application.

If open data isn’t already mentioned in your grant agreement or terms and conditions, think about updating them to share this information with applicants and grantees.

Things to include:

• A clear statement that public information might be shared as open data.
• Whether you will publish summary information only, or if you will publish details too, such as grant payments and outcomes.
• If you plan to publish any personal information (such as names or addresses), explain this clearly and give details about how grantees can tell you if they do or don’t want their data to be shared.

Things to avoid:

• Suggesting that the data you publish will only be used by certain partner organisations or for certain things. Open data is available to be viewed and used by anyone for any purpose. 
• Agreeing to share personal information by default. Don’t publish information about individuals without their explicit permission to do so. 

Telling grantees about your plans

If you are planning to publish any personal data, you will need to contact all the people involved and ask for their permission. Even if you aren’t, it’s a good idea to let your grantees know that you will be publishing your grants data in the 360Giving Data Standard. 

If you give grants to organisations, it can help strengthen your relationships with them, giving them an opportunity to share any updates with you, and giving you a chance to highlight the benefits of sharing your data. 

Further resources 

• Use our example wording for letting organisations you have funded know about your plans
• The Information Commissioner’s Office (ICO) has a comprehensive guide to data protection.
• The ICO also offers guidance about making data anonymous.
• Read this resource from the Ariadne Network, ‘Sharing Data Responsibly – A Conversation Guide for Funders‘

Download and use this example of an open data policy to create a policy for your organisation:

Remove personal data about grants to organisations

If you are planning to publish information that includes personal data, you should either:

1. Make sure you have explicit consent from the individuals involved to publish their information in your 360Giving data.
2. Remove the information or make it anonymous. 

We strongly encourage funders to remove personal information from their 360Giving data. 

Names and contact details

While information about grants you have given to organisations is not personal data, it’s important to check for personal data that might appear by accident.

For example, descriptions may include the names or contact details of individuals involved in a project or organisation.

• Check Title, Description and Recipient Org:Description fields, as well as recipient or beneficiary location data, to make sure that this information, on its own or combined, cannot be used to identify an individual.
• Look closely at any text which was originally written by applicants, especially if these fields aren’t generally checked at the assessment stage.

Home addresses

If an organisation’s address is a private home address, which is sometimes the case for community groups and small charities, the full address shouldn’t be included in 360Giving data.

In many cases, including only the town and the postcode will be enough to make sure that the individual whose home it is can’t be identified. However, you might need to take a different approach depending on the context, for example, if the address is in a rural area without many homes, a full postcode could still lead to a home address being identifiable.

Some publishers avoid the possibility of publishing home address data by using geocodes instead of addresses or postcodes.

Remove personal data about grants for individuals

Funders who give grants to individuals must take extra care to protect the privacy of the people they have supported.

All the following information should be removed from 360Giving data about grants to individuals:

• personal data in the form of names or other identifying information
• specific demographic data, such as age or gender identity, including data collected using the DEI Data Standard
• address or postcode data.

Making sure individuals who receive grants are anonymous

There are several ways that someone who has been given a grant could be identified from open grants data. It’s important to put processes in place to prevent this information from being published. The main fields to check include:

• Recipient name 
• Identifiers taken from internal systems
• Description text
• Location
• Demographic data

Name 

A person’s name is a key piece of personal data which should be made anonymous in 360Giving data.

The Recipient Ind:Name field mustn’t be left blank, so we recommend using ‘Individual Recipient’ in place of every person’s name.

Identifiers taken from internal systems

Two of the 10 core information fields in 360Giving data are unique identifiers for each grant and each recipient – Identifier and Recipient Ind:Identifier.

Typically, these will be drawn from your grants management system or database, so that the references in your internal system match the ones used in your 360Giving data.

Because they are specific to each recipient, they could potentially be used to identify that person. Who has access to your internal grants system data? How secure is it? If it can only be viewed by authorised staff, or a third party company with whom you have a data sharing agreement, it should be all right to use the system identifiers. 

Otherwise, you’ll need to use alternative unique identifiers.

Title and Description text

Searching title and description text is one of the main ways that people explore 360Giving data when they use GrantNav. 

However, title and description text about grants to individuals must be kept generic to avoid including any information that could be used to identify someone.

Examples

A grant to pay for vocational training.

• Do: Mention the area of learning or skill, and why the person is taking the course.
• Don’t: Name of the course or specific learning provider.

A grant to buy household items for an older person who is an armed forces veteran experiencing financial hardship.

• Do: Mention the type of items that will be bought and that the recipient is an older person who is a veteran.
• Don’t: Name specific brands or models of items. Don’t include detailed demographic information about the individual, such as their exact age, ethnicity and gender.

If the information you hold is very specific to each individual, it might be better to use a description of the overall grant programme instead.

Location 

For grants to individuals, don’t publish addresses or postcodes, as these could lead to the recipient being identified.

Instead, we recommend changing postcodes into Office for National Statistics (ONS) Ward level area names and geocodes.

This allows useful data to be published, which will work with the location filtering functions of GrantNav, while still protecting the privacy of individuals.

Demographic data

Specific demographic data which describes an individual’s protected characteristics – such as their age, their ethnic background or their gender identity – should not be included in published data. This information could potentially be used to identify the individual when combined with other details about the grant.

It doesn’t matter whether the demographic data has been collected through your own systems or using the DEI Data Standard.

When a funder or grant programme supports a particular group, for example, older people or people with specific disabilities or conditions, this information can be included as part of the grant programme or description fields, in general terms.

Data protection checks within your organisation

When you planned who would be involved in publishing your 360Giving data, you may have identified someone to act as ‘data controller’. They are responsible for making sure that your data protection policy is followed and that people’s privacy is protected throughout the process. They might also be the data protection lead in your organisation. 

Make a list of any data that you feel will need extra processing to protect people’s privacy, or that you are unsure about. Share this list with your data controller, to review. If your organisation’s data protection lead isn’t already involved in the project, it’s a good idea to discuss your plans with them, too. 

Make a note of any issues that you find, or changes you need to make, so that you’re aware of them next time you update your data.

Privacy checklist

No personal data should appear in your 360Giving data, unless you have informed, specific consent from the individual. If you give grants to individuals, you must follow data protection guidance before publishing your grants data.

If you give grants to organisations, your 360Giving data is less likely to include personal information. But it can sometimes still appear, so you need to make sure you’re not accidentally sharing anything that would allow someone to be identified.

Getting ready – all grant types

• Check the terms of your grant agreements and privacy policies.
• Decide whether you will inform grantees that you are publishing your grants data.
• Think about writing an open data policy, if you don’t already have one.
• Make a list of any information that needs to be reviewed or changed.
• Share your plans with your organisation’s data protection lead, or someone with similar authority. 

Your data – grants to organisations

• Check that free text description fields don’t include references to identifiable individuals.
• Think about what level of location data you can share without sharing sensitive information or personal data. If needed, convert postcodes into geocodes.

Your data – grants to individuals

System identifiers

Do any third parties have access to your grants data, without a data sharing agreement in place?	No:	Yes:
Unique application/grant identifiers from your internal systems.	You can include these system identifiers in your published 360Giving data.	Create new grant identifiers before publishing this data.
Unique recipient identifiers from your internal systems.	You can include these system identifiers in your published 360Giving data.	Create new recipient identifiers before publishing this data.

Descriptive text

Do your grant Descriptions or Titles include the following?	No:	Yes:
The name of the recipient.	You can include this Title or Description text in your published data.	Edit your Title or Description text to remove identifying data, or use alternative text, such as grant programme description or category data.
A detailed breakdown of what the funding was for.	You can include this Title or Description text in your published data.	Edit your Title or Description text to remove identifying data, or use alternative text, such as grant programme description or category data.
Specific demographic information about the recipient.	You can include this Title or Description text in your published data.	Edit your Title or Description text to remove identifying data, or use alternative text, such as grant programme description or category data.
References to a referral agency making the application on the recipients behalf.	You can include this Title or Description text in your published data.	Edit your Title or Description text to remove identifying data, or use alternative text, such as grant programme description or category data.

Geodata

Does your grant information include the following geodata?	No:	Yes:
Address details for the recipient’s home address.	No action.	Remove from data before publishing.
Postcodes for the recipient’s home address.	No action.	Convert postcode data into Ward or higher level area geocodes before publishing.