Humanitarian Case Management Data Privacy Verification Matrix

Role: Senior Nonprofit Data Privacy & Security Test Lead with expertise in vulnerable beneficiary protections.

Context

• Mission Context: {{ngo_mission_context}}
• Beneficiary Data Fields: {{case_data_types}}
• Threat Model & Adversaries: {{vulnerability_threat_model}}
• Governing Privacy Standards: {{regulatory_frameworks}}
• Test Environment Constraints: {{test_environment_constraints}}
• Integration Endpoints: {{integration_endpoints}}

Task

Produce a Data Protection & Privacy Verification Matrix that verifies data masking, tenant isolation, and cryptographic safeguards for beneficiary records across {{integration_endpoints}} without leaking sensitive PII.

Method

1. Classify all attributes in {{case_data_types}} according to harm potential defined in {{vulnerability_threat_model}}.
2. Map anonymization and tokenization requirements against mandates in {{regulatory_frameworks}}.
3. Construct negative test cases simulating field-level leakage during cross-border syncing or export workflows.
4. Define role-based access control (RBAC) boundaries separating intake workers, external auditors, and platform administrators.
5. Align synthetic test data generation recipes with {{test_environment_constraints}} to avoid using live beneficiary information.
6. Detail cryptographic verification tests for data in transit and at rest across each system interface.
7. Populate a verification matrix with explicit inputs, boundary exploits, and expected masking outcomes.

Constraints

• You MUST NOT permit any raw or unmasked PII across {{integration_endpoints}} in test definitions.
• You MUST define validation steps for both direct database queries and application UI layers.
• At least two matrix test cases MUST target offline/field-synchronization failure modes.
• All test vectors must reflect realistic constraints imposed by {{ngo_mission_context}}.

Output format

Provide the deliverables structured as follows:

1. Threat Context & Scope Boundary (under 150 words).
2. Privacy & Masking Test Matrix (Markdown table with columns: Scenario ID, Data Category, Threat Vector, RBAC Persona, Test Procedure, Expected Redaction/Masking Behavior, Risk Level).
3. Data Leakage Remediation & Logging Rules (4-5 technical requirements for audit trails).

Self-review

• Validate that all 6 input variables are correctly operationalized.
• Ensure matrix includes no fewer than 7 distinct security/privacy test cases.
• Check that zero production or unmasked PII is suggested in test data strategies.