Policy Template

Most AI policies are written for organisations with a legal team. This one is written for yours: a working AI-use policy for charity, cultural and heritage organisations, covering the questions that actually come up.

Which tools staff can use and for what. What must never go into them. How to work out whether your organisation needs to do a DPIA. What you tell trustees, funders and supporters.

It's the starting point I use with consultancy clients, ready to adapt to your organisation. It's the document you can put in front of your board.

It's free, and it downloads straight away. No email, no sign-up.

It's a Word document, so you can make it yours. If you want more of this thinking, I write it up on the Substack.

What's a DPIA, and why does everyone keep saying it?

A Data Protection Impact Assessment is the structured look your organisation takes before using personal data in a way that could put people at risk. It's something you do, not something a tool has. It matters here because supporter and beneficiary data is exactly the kind that raises the stakes, and because your board will ask. The template walks you through when one's needed and what to write down.

“A DPIA is a process designed to help you systematically analyse, identify and minimise the data protection risks of a project or plan.”