Write for the decision
Identify the reader, mandate, question and deadline. Put the requested action and the most material facts early.
Practical guide
Create a concise submission whose facts, legal analysis and recommendations can be checked and acted upon by the intended institution.
Use this guide to plan a proportionate workflow, not as a substitute for professional advice or a context-specific security assessment. Laws, institutional procedures and risk conditions differ by jurisdiction.
Identify the reader, mandate, question and deadline. Put the requested action and the most material facts early.
For each proposition, record the source, date, confidence, consent status and relevant legal standard before drafting narrative prose.
Use headings and language that distinguish direct evidence, reported allegations, contextual analysis and legal argument.
Cite the instrument and explain how the relevant obligation connects to the documented facts. Avoid lists of treaty names without analysis.
Address the actor with authority, use measurable actions and distinguish urgent steps from structural reform.
Remove unnecessary identifiers, explain technical terms, check citations and provide an accessible format. Conduct a final risk and consent review.
Completion check
Common failure modes
Implementation framework
Before beginning, name the person or institution responsible for the work, the public-interest purpose, the intended audience and the decision the output is meant to support. Confirm that the team has authority to collect, use and publish the material involved. A broad aspiration is not enough: a clear purpose determines what information is relevant and what should never be collected.
Write exclusions as carefully as objectives. State whether the activity is research, education, advocacy, referral or administration; identify the services it cannot provide; and explain who may approve changes. Clear limits reduce false expectations and help staff recognize when a request belongs with a qualified lawyer, safeguarding professional, security specialist, clinician or other competent service.
Identify everyone who may be affected, including contributors, subjects, staff, partner organizations, interpreters and people who may be identifiable indirectly. Consider who controls access, resources and publication decisions. A person may agree because they perceive that assistance, status or recognition depends on cooperation, so the conditions around consent matter as much as the form used to record it.
Assess physical, digital, legal, psychological, social and reputational risks before contact and again before disclosure. Consider retaliation, surveillance, stigma, family or workplace consequences and the effects of combining datasets. Record mitigations, residual risk and the person who can pause the work. When risk cannot be reduced to a proportionate level, the responsible decision may be not to proceed.
Choose methods that fit the objective and impose the least necessary burden. Provide information in accessible language and formats, arrange interpretation or reasonable adjustments, and allow enough time for questions. Avoid collecting sensitive material through open email, ordinary web forms or tools whose access, retention and cross-border transfer cannot be explained.
Plan roles and handovers. Define who may make contact, view identities, edit content, authorize release and respond to a concern. Use least-privilege access and separate identity information from working material where practical. A simple documented process that people can follow under pressure is safer than an elaborate procedure that exists only on paper.
Keep an acquisition record for each material item: source, date, method, original location, transformations and the basis on which it may be used. Distinguish direct experience, observation, hearsay, official assertion and analytical inference. Do not silently improve a quotation or remove uncertainty because a cleaner account supports the desired conclusion.
Test important claims against genuinely independent evidence and plausible alternative explanations. Check dates, locations, institutional competence and whether a source could know what it claims. When translation or technical analysis is material, record the method and reviewer. Verification is an ongoing judgment, not a badge automatically conferred by one tool or source type.
Bring the purpose, evidence, legal or ethical framework, risks and alternatives together in a short decision record. Name who decided, what was approved, which conditions apply and when the decision expires or must be reviewed. Separate factual findings from recommendations and retain minority or dissenting views when they reveal unresolved risk.
Apply necessity and proportionality. Ask whether the same legitimate objective can be achieved with less personal data, lower visibility, narrower distribution or a delayed release. Approval for one use does not automatically authorize another. A new audience, format, partner or context can materially change both consent and risk.
Use precise language about what is known, alleged, inferred and unknown. Attribute institutional findings, recommendations and judgments to the competent source and date them. Avoid imagery, headlines or examples that sensationalize suffering, imply guilt or reduce people to passive victims. Explain technical terms and make the main conclusion accessible without oversimplifying it.
Before release, review names, faces, metadata, locations, quotations and combinations of detail that could identify someone. Confirm licences and communication approvals separately from personal consent. Provide an accessible contact for factual correction, privacy concerns and withdrawal requests, while being honest about material that may already have been lawfully distributed or archived.
Store only what the defined purpose requires, protect it in transit and at rest, and review access throughout the project. Set retention dates for working files, identity keys, consent records and published outputs. Backups, exports, messaging attachments and local copies need explicit treatment; deleting a record from the main interface does not necessarily remove those copies.
Closure includes returning or deleting partner material, revoking accounts, documenting unresolved obligations and telling contributors what happened. Preserve the minimum accountable record needed to explain the decision without creating an indefinite archive of sensitive data. If the work transfers to another team, verify authority, safeguards and the contributor-facing explanation before transfer.
Schedule review early enough to change the work, not only to describe it after completion. Check whether the intended audience used the output, whether recommendations were acted upon and whether any person experienced an unforeseen consequence. Invite feedback through routes that do not require public disagreement or disclosure of sensitive information.
Record corrections, incidents, near misses and lessons in a form that can improve future practice. Accountability is not served by concealing mistakes, but transparency must still protect affected people. Update or retire guidance when law, technology, institutional procedure or risk conditions change, and keep visible review dates on material that readers may otherwise assume is current.
Before release, ask a reviewer who was not responsible for the original work to test the reasoning, evidence and safety choices. Provide enough time and access for meaningful review, while protecting identities that the reviewer does not need. Record disagreements and the reason for the final decision instead of treating approval as proof that every risk or factual question has disappeared.
Plan how to respond if a source disputes the account, new evidence emerges or an affected person raises a concern. A correction policy should distinguish factual amendment, clarification, withdrawal and preservation of an accountable archive. Act promptly, communicate the change where the original material was distributed and reassess any downstream dataset, translation or publication that relied on it.
A checklist helps prevent omission, but a completed box does not establish that the underlying judgment was sound. Record the evidence or decision behind important checks and adapt the workflow when the context creates a risk that the standard list did not anticipate. Escalate uncertainty rather than encouraging staff to force a complex situation into a yes-or-no answer.
At handover, give the next responsible person a concise account of purpose, permissions, open questions, review dates and any conditions on further use. Do not transfer all working material merely because it exists. Confirm which records are necessary, which must remain restricted and which can be securely deleted after the accountable record has been preserved.
Keep a concise record of who approved the purpose, what risks were identified, what consent or authority was obtained, which sources were checked, how sensitive information was protected and when the work will be reviewed. A decision log supports correction, learning and accountable handover without becoming a second store of unnecessary personal data.
Stop and obtain qualified support when the work may create immediate danger, involves confidential legal or medical information, concerns a child or another person unable to provide informed consent, or requires specialist investigation, digital forensics, safeguarding or trauma support. Do not use an ordinary website form to transmit evidence or identity documents.
This guide offers general public-interest practice, not legal, security, medical or psychosocial advice. High-risk work requires qualified local support and an organization with an appropriate duty-of-care framework.
Check the linked institution for the current version, scope and any context-specific requirements before relying on this guide.
Apply the guide
Explore new briefings, regional analysis and research as WHRF’s public programme develops.
See what’s new