Privacy

Privacy

Privacy is the discipline of protecting sensitive material while still preserving evidence that can support a claim.

Some evidence should not be made public. A private file, dataset, contract, research material, business record, identity record, incident log, creative draft, source file, client document, or internal decision may be too sensitive to expose broadly.

But privacy does not remove the need for evidence.

The purpose of this guide is to help users prepare evidence so it can be preserved, understood, checked, or relied on without exposing more material than necessary.

Privacy is not secrecy without structure. Private evidence still needs a clear evidence record.

Quick Read

• Privacy helps users preserve and verify evidence without unnecessary exposure.
• Strong privacy planning identifies what must be shown, what must remain restricted, and how the evidence can be checked later.
• Privacy does not automatically prove ownership, authorship, legality, permission, originality, accuracy, or truth.

What this means

Privacy in evidence means controlling disclosure.

It asks what needs to be preserved, what needs to be checked, who needs access, what can be shared, what should be restricted, and what should never be exposed unless the situation requires it.

A creator may want to prove a draft existed without publishing the work. A business may need to evidence a contract position without exposing commercial terms. A researcher may need to preserve contribution records without disclosing sensitive data. An AI team may need to show dataset provenance without publishing the dataset. An organisation may need to preserve cyber incident records without exposing security details.

Privacy means the evidence process should protect the material while still keeping the proof path usable.

Why it matters

A common mistake is assuming that proof requires public exposure.

That creates risk.

People may publish too much too early. Businesses may disclose confidential records unnecessarily. Researchers may expose sensitive data. Organisations may reveal operational weaknesses. AI teams may disclose datasets or licences without proper control. Creators may reveal unpublished work while trying to protect it.

The opposite mistake is also common: keeping everything private but preserving no usable proof.

That creates a different risk. The evidence exists, but nobody can check it. The record cannot be explained. The source material is hidden without a controlled route for verification. The claim becomes hard to trust.

Good privacy planning avoids both failures.

It keeps private material protected while preserving a credible route for later checking.

What strong privacy should include

A stronger privacy position usually includes:

• The private material — the file, record, dataset, draft, contract, message, log, source file, or supporting item being protected.
• The evidence claim — what the private material may need to support.
• The disclosure boundary — what can be shared and what should remain restricted.
• The access position — who may access the material and under what authority.
• The minimised proof route — how the claim can be supported without exposing more than necessary.
• The source preservation position — where the private source material is kept.
• The identifier — a hash, receipt ID, version reference, timestamp, record ID, or other reference that can help connect proof to the private material.
• The custody context — how the material is held, protected, and controlled.
• The retention and recovery route — how the material can be found later if needed.
• The verification route — how someone may check the evidence under appropriate conditions.
• The redaction or disclosure process — how partial disclosure may be handled if required.
• The claim boundaries — what can safely be said without exposing or overstating the evidence.

Privacy should be designed into the evidence record early, not improvised later.

Common weak points

Privacy evidence is usually weak when:

• private material is published unnecessarily
• sensitive files are shared before the claim requires it
• confidential records are stored without access controls
• evidence is kept private but cannot be verified
• redacted material cannot be linked to the source record
• receipts or identifiers are separated from the private file
• hashes are created but the source file is lost
• screenshots are used to avoid disclosure but do not preserve the source
• disclosure decisions are not recorded
• private evidence is held in personal accounts
• access depends on one person
• public claims imply verification that has not happened
• privacy is used as a reason for having no evidence route at all

Privacy should protect evidence. It should not make evidence unusable.

How to apply this yourself

For each private or sensitive record, create a privacy note.

Ask:

• What private material is involved?
• What claim may it need to support?
• What must be preserved?
• What must not be exposed unnecessarily?
• Who is allowed to access the material?
• What proof can be shared without revealing the material itself?
• What identifier links the proof to the private source?
• Where is the private source material preserved?
• How can the evidence be checked later under appropriate conditions?
• Can a redacted or limited version support part of the claim?
• What public wording would overstate the evidence?
• What does the private evidence not prove?

Then keep the private material, identifiers, access notes, disclosure boundaries, and verification route connected.

Do not confuse privacy with absence of evidence.

What this does not prove

Privacy planning does not automatically prove:

• ownership
• authorship
• copyright
• permission
• legality
• originality
• authenticity
• accuracy
• completeness
• absence of alteration
• absence of dispute
• that private material has been independently verified
• that EviWrite has protected, checked, verified, or backed the record

Privacy helps protect sensitive material while preserving an evidence route. It does not decide every claim about the record.

Framework-aligned claim boundary

A person or organisation may use this guide as part of EviWrite Framework alignment if they apply the guidance honestly and avoid implying EviWrite involvement.

Acceptable wording may include:

“We use the EviWrite Framework to support privacy-conscious evidence practices.”

It must not be used to imply:

• EviWrite has reviewed the private material
• EviWrite has verified the private evidence
• EviWrite has protected or stored the private record
• EviWrite has approved the disclosure boundary
• the record is EviWrite-backed
• the record is EviWrite-certified
• the record carries the controlled ⓔ mark
• EviWrite has endorsed the organisation’s privacy controls

Framework-aligned means public guidance was followed.

EviWrite-backed means the record was created through EviWrite or an authorised evidencing channel.

Related checklist

Use the Privacy Checklist to check whether private material, access controls, identifiers, disclosure boundaries, verification routes, and claim limits have been preserved clearly.