Mention data ethics and people think of huge technology companies, congressional hearings and philosophical debates. For an ordinary business, it's more down to earth. It's about what you collect, what you tell people you'll do with it, how you protect it, and whether the decisions you automate treat people fairly.
You don't need a department for this. You need a few habits and the willingness to ask "should we?" as well as "can we?"
Collect less
The simplest ethical step is also the cheapest. Before you add a field to a form or an event to your tracking, ask what you'll use it for. If there's no answer, don't collect it.
Data you don't have can't be leaked, misused or subpoenaed. It also doesn't need storing, securing or explaining. Many businesses I speak to collect everything on the theory that it might be useful someday. Most of it never is, and in the meantime it's a liability.
Be clear with people
Tell customers what you collect and why, in words they can follow. A privacy policy written for lawyers doesn't count if no one can understand it. A short, plain explanation next to the form does far more.
Ask for consent where it's needed, and make it real. A box that's pre-ticked or buried in terms isn't consent in any useful sense. Make it as easy to say no, or to change your mind later, as it was to say yes.
Use data for the purpose you gave. If someone shared their email to get a receipt, adding them to a marketing list is a breach of that expectation, even if nothing in your system stops you.
Look at what your models do
Whenever you use data to make a decision about people, such as who gets a discount, a loan, a call back or a job interview, check what the model is actually doing.
Models learn from history, and history contains biases. A system trained on past hiring decisions may learn to repeat them. A pricing or credit model might lean on something like a postcode that quietly stands in for religion or income.
Some practical checks. Look at outcomes by group and see whether they differ in ways you can't explain. Understand which inputs matter most. Keep a human able to review and override important decisions. And for anything that significantly affects a person, be able to explain why it happened.
Keep it safe
Ethics and security overlap. Holding personal data means looking after it.
Limit who can see it. Not everyone needs access to customer names and phone numbers to do their job, and analysts can often work with anonymised data. Use strong passwords and two-step sign-in. Keep software updated. Delete data you no longer need, on a schedule, so it doesn't pile up. And have a plan for what you'll do if something goes wrong, including who you'll tell.
Know the rules that apply
India's Digital Personal Data Protection Act, 2023 sets out obligations around consent, purpose and how personal data is handled. Depending on who your customers are, other laws such as the EU's GDPR may apply as well. I'm not a lawyer, and you should get proper advice for your situation, but the principles above are a sound basis for most of what these laws ask for.
A few questions worth asking
When you start a new project involving personal data, these take five minutes and can save a lot of trouble.
- What are we trying to achieve, and do we need personal data to do it?
- Would our customers be comfortable if they saw exactly how we're using this?
- Who could be harmed if this were wrong, leaked or misused?
- How will someone find out and challenge a decision that affects them?
- When will we delete it?
It's also good business
People are increasingly aware of how their data is used, and they notice when a company is careless. Businesses that treat data with care earn trust, and trust is hard to buy. Doing the right thing here is rarely at odds with doing well.
If you want a view on a specific project, or a review of what you're collecting and why, that's something we help with.