What to Do If Your Church Has a Data Breach

A breach is more than a hack

A personal data breach is when personal data is lost, destroyed, changed or seen by someone who shouldn’t see it, by accident or on purpose. An email sent to the wrong list, a lost register or a supplier being hacked all count.

Church records reveal people’s faith, which the law treats as sensitive. That makes a breach more likely to put people at risk.

You have 72 hours to tell the ICO

If the breach is likely to put people’s rights at risk, report it to the ICO within 72 hours of becoming aware of it. You don’t need every detail to report. Tell them what you know and follow up.

If the risk to people is high, you must also tell the people affected, without undue delay, so they can protect themselves.

Record every breach, even small ones

Keep a record of every breach, including ones you decide not to report. Note what happened, when you found out, who was affected and what you did. The ICO can ask to see it.

Tell the Charity Commission too

Trustees of registered charities must report serious incidents to the Charity Commission, and significant data breaches or losses are included. If your income is over £25,000, your annual return asks you to confirm you’ve reported them all.

When the breach is at your supplier

Your church is still responsible for its members’ data when a supplier holds it. In August 2026 the Charity Commission published guidance after a cyber incident at Beacon, a charity database supplier. Many affected charities had to file serious incident reports and consider telling the ICO.

Ask any supplier where your data is held, how they’ll tell you about a breach and how quickly. Their answers should be in their data processing agreement.