Reflections on BD4D

Akshay Badlani is a senior and coterminal Masters student at Stanford University, studying Computer Science, Symbolic Systems, and Public Policy. We were delighted to welcome him to Tech Matters as a summer intern this year, focusing on several key projects for Better Deal for Data; these are his reflections on the experience. We look forward to seeing his continuing impact as he works to improve people’s lives and livelihoods through responsible business, policy, and technology for good!

What Responsible Data Governance Looks Like in Practice

As the Better Deal for Data (BD4D) team develops a practical standard for trustworthy data practices in the social sector, two questions specifically came to mind: what does responsible data governance actually look like when organizations have to put very broad principles into practice? And what does this mean for technologists?

These questions shaped a large part of my internship at Tech Matters. I specifically looked at how nonprofits currently govern and communicate their data practices. After this, I compared those approaches with the seven BD4D Commitments made by organizations to the individuals and communities they serve: Purpose, Ownership, Control, Monetization, Protection, Research, and Binding. My goal was not to determine which organizations “matched” the Commitments perfectly, but rather to understand where nonprofit practices already resemble one another, where their governance approaches differ, and what exactly those differences can teach us about building practical standards for responsible data use.

For this process, I reviewed 195 publicly available documents from 65 nonprofits of all sizes, working across education, healthcare, human services, technology, agriculture, and advocacy. These documents included posted privacy and data protection policies, terms of service, AI policies and principles, plain language data statements, and other public governance materials from the nonprofits.

For each organization, I looked at different questions, such as: What data does the organization say it collects? Why does it collect that data? How can the information be used or shared? What choices do individuals or end-users have? How is data protected or retained? And how clearly are those practices communicated to the people affected by them?

Looking Across the Nonprofit Sector

One of the findings that became apparent through my research is that data governance is not absent from the social sector, but it is unevenly expressed.

Privacy policies were very widespread. Out of the 65 organizations, 59 had clearly identified privacy or data protection policies. But other forms of governance were much less consistent. I could only find 15 organizations that had a clearly identified public AI policy or set of AI principles. Plain language communication was also very uneven. From my findings, I identified only 25 out of the 65 nonprofits that had a clearly identifiable plain language data statement.
These differences matter because having a written policy is not the same as putting it into practice. An organization might have strong internal safeguards, but if the people providing their data cannot easily understand how their information is used, trust and accountability are affected. In fact, through my research, it is very apparent that many of the organizations share similar values, like privacy, transparency, security, and user control. However, these broad commitments only become meaningful through specific choices, such as deciding exactly what data to collect, who can access it, how long to keep it, and what rights people retain over their information after sharing it.

Comparing Existing Practices with BD4D

This became very clear when I compared the findings with the seven BD4D Commitments. The Purpose commitment, which requires the data collection to advance a social good goal (and not solely to benefit private parties), was reflected across the sample, as almost all organizations generally connected data use to their mission, services, research, security, or another stated charitable purpose. The Control (data access and deletion) and Protection (safeguarding sensitive data and respecting privacy law) commitments were also frequently addressed, although the specific rights and safeguards often varied.

The other Commitments were much more difficult to evaluate based on publicly available documents. The Ownership commitment was one of the clearest examples: of the 65 organizations, I found that 60 of them did not have enough publicly available information to determine a clear alignment with BD4D’s Ownership commitment that an organization will not claim ownership of an individual’s data. The Research commitment (data will be anonymized, and free access to published research will be given to those whose data is used) and Binding commitment (a binding promise to uphold all of the BD4D Standard) had similar challenges, where organizations often addressed pieces of these ideas without making comprehensive public commitments.

I want to emphasize that this distinction is important. A lack of public information does not necessarily mean that an organization lacks an internal practice; however, from the perspective of a person whose data is being collected, what is visible still significantly matters. People can only make informed decisions based on the information available to them.

This project also reinforced why responsible data governance has to account for context. A small community organization, a healthcare nonprofit, and a global humanitarian organization may all want to use data responsibly, but they face different risks, resources, technical systems and processes, and community expectations. A useful framework needs a meaningful and common baseline, as well as sufficient flexibility to work across different environments.

For this project, I reviewed the source material and then recorded relevant practices, examples, and observations in a structured dataset. I then compared those findings across organizations and against the BD4D Commitments. To help manage a large qualitative dataset, I used a temporary ChatGPT conversation to organize findings into a consistent spreadsheet format and flag possible inconsistencies for review (no nonpublic information was shared). The evaluation and judgment were based on my reading of the original documents.

From Data Governance to Technology Design

One of my biggest takeaways from this project is that this work extends beyond nonprofit policy and into how technology is designed and deployed itself.

The data governance development process does not begin when a privacy policy is written. The process actually begins during the product design phase. Technologists must decide, when designing the product, what data to collect, how permissions and deletions work from a technical standpoint, and where that information is shared. By the time these decisions appear in privacy policies, many of the system’s possibilities and limitations have already been determined.

This means that technologists should be asking governance questions as design questions: Do we actually need this data? What does the person providing it expect will happen to it? Can they meaningfully control it later? Can we even find someone’s data to delete it later?

For me, this was the broader lesson of the internship. Building responsible technology means taking into consideration how people will be affected by a system’s design, rather than adding rules after technical decisions have already been made. A truly better deal for data depends on making trustworthy principles concrete enough to shape the everyday decisions of the people and organizations building with data.