For UK charities that handle sensitive data

Are your staff analysing donor data in public AI tools like ChatGPT, Gemini, and Claude?

Under UK law, that's a problem.

That's where I come in. I help charities move off third-party AI onto private in-house AI that does the same job without the risk, tuned to your work and grounded in your own data.

It's probably already happening in your charity

Whatever your policy says, people on your team are likely using AI to get through the day, with ChatGPT, Gemini, or Claude. A beneficiary case note pasted in for a quick redraft. A long grant agreement summarised. A donor record tidied up. None of it reckless, just useful.

But when a staff member pastes that record into a public AI tool, it goes to a US company and sits in logs you cannot see or audit. Under UK law the responsibility is yours, not theirs. Every organisation has that exposure. For a charity, three things make it sharper.

The stakes

The most sensitive data there is

Beneficiary records can carry health, hardship, immigration status, or safeguarding detail. Under UK GDPR that's special category data, the most protected tier the law has.

The stakes

Trust is what you run on

A company that leaks data loses customers. A charity that leaks a beneficiary's or supporter's data can lose the public confidence the whole organisation depends on. It's the hardest asset to win back.

The stakes

Your trustees are accountable

Trustees answer for the people and information in the charity's care. The Charity Commission expects sound risk management, and the ICO can act when data is mishandled. "A staff member pasted it into ChatGPT" satisfies neither.

If the ICO or a major funder asked what supporter data had been through which AI tools, would your charity have a clean answer?

Now picture the same work, done safely

None of this means telling your team to stop. Banning these tools rarely works, and the productivity is real. The fix is to change where the data goes, not what your staff can do.

Imagine a private assistant that runs inside your own systems. Your team paste the same safeguarding note, the same donor record, the same case file, and ask it the same questions. It feels like the ChatGPT they already know. Three things change.

What changes

Your most sensitive data stays put

Beneficiary records, donor details, safeguarding notes: they stay inside your own systems. No US company, no logs you cannot see, nothing handed to a stranger to train on.

What changes

Nothing to leak, nothing to explain away

Because the data never reaches a third party, there is nothing for someone else to lose. You can tell a supporter or a funder exactly where their information lives: with you.

What changes

An answer your trustees can stand behind

It runs in infrastructure you control, in the UK, and you are not at the mercy of a vendor in another country changing its rules. That's the sound risk management the Charity Commission and the ICO expect.

And because it is yours, it does more than the public tools can. It is tuned to how your charity actually works and grounded in your own material: your policies, your past winning bids, your case records. It can even connect to the databases and systems you already run, so it answers from what you actually hold rather than guessing.

That's private AI: the same help your team already wants, on data that never leaves your control.

"He is a joy to work with as he is flexible, efficient and a great communicator. We now have a system which is far more intuitive for our visitors and 7,000+ members, which ultimately allows us to better achieve our mission of supporting the interdisciplinary research community."

Joe Yates & Steph Ray, The London School of Hygiene & Tropical Medicine

"Having worked with Pete, I have to say he's a great guy and an exceptional consultant and developer. Pete's vast experience and knowledge along with being a great communicator made him a great mentor for the development team."

Matt Wagg, Developer, Comic Relief

About me

I've spent over 25 years building the data architecture under big software for UK organisations.

The platforms have changed (Perl and Python before the web was the default, Drupal and Laravel through the 2010s, private AI today) but the work hasn't. It's still about getting messy data out of legacy systems and into shape so something useful can sit on top.

Since 2009 I've done that for over 45 UK organisations. Private AI is just the new layer on top. The data plumbing underneath is still the hard part.

A few you may recognise:

London School of Hygiene & Tropical Medicine Nokia Danone Tate Royal Meteorological Society BMJ McCain The Bookseller Comic Relief Red Nose Day Hospice UK RNIB Sun Microsystems Barclays CLPE Tufts University YMCA Twitter Channel 4 European Lung Foundation

"We have worked with many developers and can confidently say that Pete is by far the best, an exceptional coder and consultant with an impressive skill set."

Kathryn Maxwell, IT Project Manager, Royal Meteorological Society


Get in touch

Tell me who you are and what your organisation does. If any of this sounds like your situation, that's a good place to start. I'll let you know honestly whether I can help. Even a 30 to 45 minute call often leaves people with a clearer picture of the path forward, whether or not we end up working together. From there it's whatever fits: sometimes you don't need me, sometimes a short piece of scoping work makes sense first, and sometimes you already know what you want and we get straight to the build. There's no set process you have to follow.

For context: I work mainly with UK charities and non profits, with chief executives, operations and finance directors, programme leads, and the people who look after data and IT. Respectfully, I don't work with recruitment or development agencies.

Email: peter@peterbrady.co.uk