Safeguarding and sensitive data
Organisations that work with survivors of violence, children, people with disabilities or people in legal trouble hold the most sensitive data in the country. Handling it badly can cost someone their safety.
Principles
- Collect the minimum. If you do not need a detail to help the person, do not record it.
- Case files are seen only by the caseworker and their supervisor; every access is logged.
- Statistics are counts, never lists. A donor report says "42 women supported", never who.
- Consent is recorded and can be withdrawn; minors are flagged and protected further.
- Data is deleted when the retention period ends — and the deletion is logged too.
On Society of Timor, case management is encrypted, role-gated and never exportable; it is reviewed by the platform's security team before any organisation switches it on.
This guide is general information, not legal advice. Laws and donor rules change — for registration or a grant agreement, check with FONGTIL, the Ministry of Justice or your funder.