Does GDPR Apply to Churches?

Yes. UK GDPR and the Data Protection Act 2018 apply to any church that keeps information about people, whatever its size.

Church records need extra care, because being part of a church reveals a person’s religious beliefs. The law treats that as special category data. Churches can usually keep it about members, former members and regular contacts, if they don’t share it outside the church without consent. One-off visitors are different, and need to agree.

Churches must also tell people how their information is used, keep it secure and answer requests within one month. If a breach puts people at risk, they must report it to the ICO within 72 hours.