How to Write a Privacy Notice for Your Church
Updated 21 October 2026
Why your church needs one
Everyone has the right to know what you do with their information. A privacy notice is how you tell them. Church records also show people’s faith, which the law treats as sensitive, so being open matters even more.
What it must always say
- your church’s name and how to contact you
- each purpose you use people’s information for
- the lawful basis for each purpose
- how long you keep it, or how you decide
- people’s rights, such as to see their information or have it corrected
- their right to complain to the ICO
The right to object must be pointed out clearly and separately, not buried in the rest.
Extra things to add if they apply
- who you share information with, such as HMRC for Gift Aid and your software suppliers, as specifically as you can
- your legitimate interests, if that’s a basis you rely on
- how people can withdraw consent, which must be as easy as giving it
- whether information goes outside the UK, and how it’s protected
- whether people have to give you their details, and what happens if they don’t
Choosing your lawful bases
Most of what a church does, such as rotas, pastoral care and keeping in touch, can rest on legitimate interests. Keeping accounts and Gift Aid records is a legal obligation. Newsletters and photos usually need consent.
Because church records reveal faith, you also need a condition for that sensitive data. A religious not-for-profit body can use one for members, former members and people in regular contact. The information mustn’t be shared outside the church without consent.
When to give it
Give people your privacy notice when you collect their details. Put a link on your welcome cards, sign-up forms, website and member area, so it’s always easy to find.
Keep it short and plain
Use everyday words, short sentences and headings people can scan. A short summary at the top, with the detail below, works well. Our free church privacy notice template is written this way, and you can fill in your church’s details online.
Questions churches ask
- Do we have to name our software suppliers?
- You must say who you share information with. Name them, or at least describe them as specifically as you can.
- How often should we update it?
- Whenever you change how you use people’s information, and at least once a year. Tell people about any important change.
- Do we need to send the notice to the ICO?
- No. It’s for the people whose information you hold. Keep it on your website and give it out when you collect details.
Data protection tools built in
Church Member Software tracks data requests against their deadlines, keeps a breach log and records consent, so your privacy notice matches what you do.
Sources
This guide summarises official guidance. It isn’t legal or tax advice, so check anything you’re unsure about with HMRC, the ICO or an adviser.