Building trust in a digital age: How the UN approaches data protection programmes

In today’s interconnected world, data plays a crucial role in international development, humanitarian response, and peacekeeping operations. The United Nations (UN), as a global steward of human rights and a provider of essential services in fragile and complex environments, increasingly relies on personal data to fulfil its mission. From refugee registration systems to health data for vaccine distribution, the UN collects, processes, and shares large volumes of sensitive information daily about the world’s most vulnerable individuals. 

With this reliance on data comes both opportunity and risk. The misuse or mishandling of personal data can lead to significant harm, compromising privacy, security and even the safety of individuals. The UN has increasingly recognised that data protection is not merely a technical or legal concern, but a foundational component of trust, accountability, and ethical operations. Over the past decade, the UN has taken significant steps to formalise its approach to data protection, developing system-wide frameworks designed to uphold the dignity and rights of those it serves. 

This article outlines the unique legal position of the UN in relation to data protection, introduces how the UN has created a principle-based foundation data protection across UN system organisations, and examines interagency efforts to coordinate and harmonise approaches across the system. It concludes by considering the challenges and opportunities ahead of the UN in this field. 

The UN’s Unique Position on Data Protection 

Unlike governments or corporations, the UN operates outside national jurisdictions and is not bound by any national or regional data protection laws, such as the GDPR or CCPA. This legal independence, while necessary for operational neutrality, means that the UN must define its own data protection standards. These standards are rooted in: 

• International human rights law, such as the right to privacy under Article 12 of the Universal Declaration of Human Rights and Article 17 of the International Covenant on Civil and Political Rights (ICCPR) 
• Humanitarian principles, including humanity, neutrality, impartiality and independence, and 
• Operational best practices, including data minimisation, purpose limitation and accountability mechanisms 

Each UN agency, fund or programme, such as UNHCR (the UN Refugee Agency), UNICEF, WFP and WHO must interpret and implement these standards within its own operations. For example, UNHCR developed the Policy on the Protection of Personal Data of Persons  of Concern to UNHCR in 2015, and the General Policy on Personal Data Protection and Privacy (GDPP) and UNICF developed its Policy on Personal Data Protection and Privacy (PPDP). 

HLCM Principles: A Common Foundation 

To promote coherence across the system, the UN High-Level Committee on Management endorsed the ‘Personal Data Protection and Privacy Principles’ (‘HLCM Principles’) in 2018. These serve as a common framework for the processing of personal data by UN System Organisations when carrying out their mandated activities.  

The Principles are: 

1. Fair and Legitimate Processing: Processing must be fair and in accordance with the organisation’s mandate 
2. Purpose Specification: Data must be processed for specific purposes, consistent with the organisation’s mandate, taking into account the balancing of relevant rights, freedoms and interests.   
3. Proportionality and Necessity: The processing of personal data should be relevant, limited and adequate to fulfil the purposes of processing. 
4. Retention: Personal data should only be retained for as long as is necessary to fulfil the specified purpose. 
5. Accuracy: Personal data should be accurate and up to date 
6. Confidentiality: Personal data should be processed with due regard to confidentiality. 
7. Security: Reasonable and appropriate safeguards must protect personal data. 
8. Transparency: Data subjects should be informed about how their data is used, as appropriate and where possible. 
9. Transfers: UN organisations may transfer personal data to parties who afford appropriate protection to the personal data. 
10. Accountability: UN organisations should have policies and mechanisms in place to adhere to the Principles.  

Though it is not required that UN System Organisations adhere to the HLCM principles, several have chosen to do so, including UNHCR, UNICEF, WFP, WHO and UNDP, among others.  

Data Protection in the Field: Context Matters 

The UN often works in environments where national data protection laws are weak or non-existent, and where the risks of misuse by states, armed groups, or even international actors are high. This makes a context-sensitive approach essential. 

For example, the implications of biometric data collection, such as fingerprints or iris scans, in a refugee camp can enhance aid delivery by ensuring accurate identification and reducing fraud. However, if the data is leaked or shared inappropriately, it could expose individuals to surveillance, targeted violence or discrimination. To mitigate such risks, UN agencies have sought to reduce risk through a number of initiatives, including:  

• UNHCR’s data protection policies emphasise the importance of informed consent, data minimisation and proportionality, and security to protect against unauthorised third party access 
• The Joint Statement on Data Protection and Privacy in the COVID-19 Response, which emphasised the need ensure the rights to privacy are protected when using data and technology, in line with the HLCM principles  
• These examples highlight how the UN is seeking to be proactive in its approach to data protection, embedding data protection principles from the outset of systems and programs.  

Interagency Coordination and Harmonisation 

Given the UN’s decentralised structure with over 40 agencies with different mandates, tools and resources, a coordinated approach to data protection is both challenging and beneficial. To foster shared learning and avoid duplication, the UN Privacy Policy Group (UNPPG) was established as an informal network of privacy professionals from across the UN. The UNPPG allows its members to: 

• Share policies, templates and case studies 
• Provide peer support on difficult data protection matters 
• Work towards interoperability of systems and approaches. 
• This collaborative model helps avoid duplication, raise standards, and build a shared culture of responsible data use. 

Meanwhile, strategic initiatives like the UN Data Strategy and the Secretary-General’s Road Map for Digital Cooperation emphasise data protection as a pillar of digital trust. These initiatives call on UN entities to embed privacy, ethics and inclusion into their digital transformation efforts, particularly as technologies like AI, big data, and predictive analytics become more prominent. 

Looking Ahead: Challenges and Opportunities 

Though the UN still faces challenges in operationalising data protection, including building capacity in data protection teams and balancing data protection with urgent operational needs, there are also powerful opportunities.  

The UN’s global reach and ethical authority position it to lead by example in developing rights-based data governance models that can be emulated by other national and international actors. By continuing to invest in data protection programmes, the UN is not only safeguarding personal data but reinforcing the trust that communities place in its mission. 

As humanitarian and development work becomes increasingly data-driven, the question is not whether to protect data, but how to do so in ways that are ethical, inclusive, and sustainable. For the UN, that means building data protection not as a compliance exercise, but as a core value of principled action in a digital age. 

Trilateral Research provides UN System Organisations with data protection support and advisory services. Please contact our advisors if you have any questions about how data protection is operationalised in such organisations.