GDPR for Churches: A Plain-English Guide

Why church data needs extra care

Being on a church’s records, or coming to its services, reveals something about a person’s religious belief. UK GDPR calls that special category data, and it needs more protection than an ordinary contact list.

Pastoral notes, prayer requests and access needs often reveal health information, which is special category data too.

The rule that lets churches hold this data

You need two things: an ordinary lawful basis, such as legitimate interests for running church life, and a condition for special category data. For churches, that condition is usually the one for not-for-profit bodies.

It covers you when:

• the data is about members, former members or people in regular contact with the church
• you use it for the church’s own activities, with sensible safeguards
• you don’t share it outside the church without the person’s agreement

It doesn’t cover one-off visitors or enquirers you’ve had no regular contact with. For them, ask for their agreement or keep no more than basic contact details.

Sharing outside the church needs agreement

A public online directory, a list sent to another church or details passed to a wider denomination all count as sharing. Get the person’s explicit agreement first.

An opt-in directory that only church members can see, where each person chooses what to show, is the safer approach.

Answering requests about people’s data

Anyone can ask what you hold about them. You have one calendar month to reply, which can be extended by two months for complex requests.

If you need them to clarify what they’re asking for, the clock stops until they reply. Your search only needs to be reasonable and proportionate. Check pastoral notes for other people’s information before sending anything.

People can also ask you to correct, delete or stop using their data. You can refuse to delete records the law makes you keep, such as Gift Aid records, but you should explain why.

Complaints and breaches

Since 19 June 2026, organisations must make it easy to complain about how they use data. You must acknowledge a complaint within 30 days, look into it and tell the person the outcome.

If data is lost or leaked and it puts people at risk, tell the ICO within 72 hours of finding out. Keep a record of every breach, even small ones you don’t report.

Don’t keep data forever

Decide how long you keep records of people who’ve left, one-off visitors and old emails, then stick to it. Gift Aid and giving records must be kept for 6 years. Safeguarding records often need keeping much longer, so check your denomination’s guidance.

If you do DBS checks, don’t keep copies of the certificates. Note the date, type, certificate number and the decision instead.

The ICO fee

Most organisations that handle personal data pay the ICO a yearly fee. Many churches are exempt under the not-for-profit rules, but using CCTV can change that. The ICO has a short self-assessment to check.