GDPR for churches: a practical guide with checklist

Yes. The only exemption is for purely personal or household activity: the pastor’s own phone contacts used to call friends. Once the church keeps a membership list, a volunteer rota, a giving record or a congregation WhatsApp group, that processing belongs to the church and GDPR applies, regardless of size or whether the church is a registered charity.

In GDPR terms the church is the controller: it decides what data to collect, why and how. Whoever governs the church (trustees, elders, the board) answers for those choices. Suppliers that handle data on the church’s behalf (church software, email service, cloud storage) are processors.

Article 9 prohibits processing data that reveals religious beliefs unless one of the listed exceptions applies. For a church nearly everything falls into this category, because simply appearing in its records says something about a person’s faith.

Special-category data needs two things: a basis under Article 6 (for example legitimate interests, or the membership relationship) and one of the Article 9 conditions. Two conditions matter for churches.

• Article 9(2)(d), legitimate activities of a religious body. A not-for-profit body with a religious aim may process data about members, former members and people in regular contact with it, for its activities and with appropriate safeguards, provided the data is not disclosed outside the body without consent. This covers the membership register, attendance, rotas, church records and internal accounts.
• Article 9(2)(a), explicit consent. Use it where (d) doesn’t reach: a first-time visitor, photos and names on the website or social media, a contact directory shared between members, passing data to third parties. Consent must be freely given, specific, recorded and as easy to withdraw as to give.

Give the privacy notice (Article 13) when you collect the data: on the membership form, the welcome card, the giving page. Keep it short and plain, and cover at least:

• who the controller is (church name, address) and how to contact them about privacy;
• what data you collect and why (church life, pastoral care, accounts, communications);
• the lawful basis for each purpose, flagging what needs consent;
• who receives the data and which suppliers process it, including any transfer outside the EU or UK;
• how long you keep it;
• people’s rights, including the right to complain to the regulator.

For consent, one unticked box per purpose (photos online, shared directory, WhatsApp, newsletter) is the cleanest approach.

Everyone can ask to access their data, correct it, erase it, restrict its use, receive it in a portable format and object to some processing. The church must answer within one month (extendable by two more for complex requests, telling the person).

1. 1

   Log the request

   Date received, who asked, what for. Check identity if you don’t know the person.

2. 2

   Find all the data

   Church software, spreadsheets, email, groups, paper files. This is where a record of processing saves hours.

3. 3

   Check the limits

   Some data may have to stay (accounting records required by law, for example): explain that in your answer.

4. 4

   Reply in writing

   With the data requested or what you did. Keep a copy of the reply.

• Record of processing activities (Article 30): the exemption for organisations under 250 staff doesn’t apply when special-category data is processed, so a church needs one. A table is enough: activity, people concerned, data, lawful basis, who has access, suppliers, retention.
• Privacy notice for members, visitors and donors.
• Consent forms, with the wording version and date.
• Processor agreements (Article 28): a written contract with every supplier processing data for the church. Reputable suppliers publish one as a DPA.
• Guidance for people with access: administrators, treasurer, leaders. A few lines on what they may see and how to protect it.
• Breach log, including breaches you did not have to report.

A Data Protection Officer is mandatory only for large-scale processing of special-category data, which a local church typically isn’t. Naming one person as the privacy contact still helps a lot.

GDPR sets no fixed periods: keep data only as long as needed and decide that in advance. A written policy, even half a page, stops archives from growing forever. Here is a starting point to adapt.

A breach is any loss, unauthorised access or disclosure: the church office laptop stolen, the member list emailed to the wrong address, a church software account compromised.

1. 1

   Contain it

   Change passwords, ask the recipient to delete, revoke access.

2. 2

   Assess the risk

   Which data, how many people, who saw it. With religious or health data the risk is rarely zero.

3. 3

   Report within 72 hours

   If the breach is likely to pose a risk to people, report it to your supervisory authority (the ICO in the UK). You can add details later.

4. 4

   Tell the people affected

   If the risk is high, tell them in plain words, with practical advice.

5. 5

   Record it

   Log every breach, reported or not, with the decisions taken and why.

Your software supplier is a processor: the church remains the controller and must choose carefully. Questions to ask:

• Is there a data processing agreement (DPA) and a public list of sub-processors?
• Where is the data hosted? Are there transfers outside the EU/UK, and with which safeguards?
• Can you export everything about one person, and the whole church, at no cost?
• Can you truly erase a person, including copies in logs and attachments?
• Are there role-based permissions, so the treasurer sees giving and the children’s leader sees only their group?
• Is there an activity log of who did what?

The full set of criteria is in how to choose church management software.

Assemblea was designed around the fact that church membership is special-category data. The church stays the controller; Assemblea is its processor under a public agreement.

• EU-hosted data, a public sub-processor list, no advertising trackers.
• Export for a member, visitor, donor or the whole church; erasure that also removes attachments and leftovers; restriction of processing with one switch.
• Recorded consent with date, wording version and purpose on visitor forms, donations, website publication, the member directory and WhatsApp.
• Data-subject request queue and breach register with notification deadlines.
• Role-based permissions on every section, private prayer requests visible only to those allowed, and a tamper-evident activity log.