Does a small church need a privacy notice?

Yes. Any church that keeps information about people must tell them how it’s used, whatever its size.

Do we need consent to keep members’ details?

Usually not. Most churches rely on legitimate interests and the condition for religious not-for-profit bodies. You need consent for things like photos online, sharing details outside the church and most email news.

Is a privacy notice the same as a data protection policy?

No. A privacy notice is for the people whose information you keep. A data protection policy is for your team, and says how you look after information. A retention policy is one part of it.

Is this template legal advice?

No. It’s based on ICO guidance, but your church is responsible for making sure its notice is accurate. If you’re unsure, ask your denomination or an adviser.

Free Church Privacy Notice Template

Written for UK churches, in plain English. It covers what business templates miss: religious belief, Gift Aid and safeguarding. Add your details, delete anything that doesn’t apply, and publish it.

Free
No sign-up
Word and PDF
Updated 18 October 2026

A starting point, not legal advice. Check it matches how your church works, and ask your denomination or an adviser if you’re unsure.

1. Add your church’s details

Optional. What you type goes straight into the document. It stays on your computer and isn’t sent to us.

Your church’s name

Your church’s address

Registered charity number(optional)

Leave it blank if your church isn’t registered.

Who to contact about data protection

A role works better than a name, as it stays right when people change. For example, “our church administrator”.

Their email address

Date of this version

For example, 1 November 2026.

2. Download or print

Download Word file

The Word file opens in Microsoft Word, Google Docs, Apple Pages and LibreOffice. Or download the blank PDF.

Preview

Privacy Notice

[Church name]

This notice explains what information we keep about you, why we keep it and what your rights are. It covers members, regular attenders, volunteers, givers and anyone else in contact with the church.

Who we are

[Church name] is responsible for the personal information described in this notice. In data protection law, we’re the “controller” of it. Our address is [church address].

If you have a question about this notice or your information, please contact [our church administrator] at [email address].

Note for your church: If your church is part of a denomination or diocese, check whether it has its own privacy notice. It may also be responsible for some records, such as registers of baptisms and marriages. This note isn’t printed, and you can delete it from the Word file.

What we keep

Depending on how you’re involved in church life, we may keep:

your name, address, phone number and email address
your date of birth, and who else is in your household
your involvement in church life, such as membership, the services and groups you come to and the roles you volunteer for
records of your giving and any Gift Aid declarations
notes made to support you pastorally, including prayer requests you share with us
for some volunteer roles, safeguarding records and details of DBS checks
records of the emails we send you, and your choices about hearing from us
[photos taken at church events, if you’ve agreed]

Note for your church: Delete anything you don’t keep, and add anything that’s missing, such as hall bookings or a nursery. This note isn’t printed, and you can delete it from the Word file.

Why this information needs extra care

Being part of a church says something about your religious beliefs, and notes about your health, such as a prayer request, may do too. Data protection law calls this “special category” information and gives it extra protection.

As a religious not-for-profit body, we can keep it about members, former members and people in regular contact with us. We only use it for the church’s own activities, and we won’t share it outside the church without your consent.

Why we use it, and our lawful basis

The law says we need a reason, called a lawful basis, for each way we use your information. Ours are:

What we use it for	Our lawful basis
Keeping in touch about church life, such as service times, rotas and meetings	Legitimate interests: running the church and caring for its members
Organising services, groups, events and volunteers	Legitimate interests
Caring for you pastorally	Legitimate interests
Claiming Gift Aid on your gifts and keeping the records HMRC needs	Legitimate interests to make the claim, and legal obligation to keep the records
Keeping our accounts	Legal obligation: charity law requires us to keep accounting records
Keeping children and adults at risk safe, including DBS checks for some roles	Legitimate interests. For DBS check details, the condition for safeguarding children and individuals at risk in the Data Protection Act 2018
Sending you news, appeals and event invitations by email	Consent
[Taking and sharing photos of church events]	[Consent]

Note for your church: If your church emails some people under the charity soft opt-in, add it here. Our guide to church email consent explains when you can use it. This note isn’t printed, and you can delete it from the Word file.

Where we rely on your consent, you can withdraw it at any time by contacting us. That won’t affect anything we did before you withdrew it.

You don’t have to give us your information. But without your name, home address and a declaration, we can’t claim Gift Aid on your gifts.

Who we share it with

We never sell your information. We only share it:

with HMRC, when we claim Gift Aid on your gifts
with companies that provide services to us, such as our church management software and email service. They can only use it on our instructions
[with our denomination or diocese, only with your consent]
if the law requires it, or to protect someone from harm, for example by reporting a safeguarding concern
with anyone else, only with your consent

Where it’s stored

Our records are stored [in the UK]. If a service provider stores information outside the UK, it must protect it in the ways UK law requires.

Note for your church: Ask each of your suppliers where they store information, and change this section to match. This note isn’t printed, and you can delete it from the Word file.

How long we keep it

We keep information only for as long as we need it. If you leave the church, we keep your record for [2 years] and then delete it, apart from anything the law requires us to keep.

For example, HMRC requires us to keep Gift Aid declarations for 6 years after the end of the accounting period of the last gift claimed. Our data retention policy has the details, and you can ask us for a copy.

Your rights

You have the right to:

ask for a copy of the information we hold about you
ask us to correct anything that’s wrong
ask us to delete your information, unless the law requires us to keep it
ask us to limit how we use it
object to how we use it, and stop us sending you news and appeals at any time
ask for information you gave us in a format you can take elsewhere, where this applies
withdraw any consent you’ve given, at any time

To use any of these rights, contact us using the details above. We’ll reply within one month, and there’s normally no charge.

We don’t make decisions about you using computers alone.

Complaints

If you’re unhappy with how we’ve used your information, please tell us first using the details above. We’ll acknowledge your complaint within 30 days and tell you what we’ve done about it.

You can also complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator. Visit ico.org.uk/make-a-complaint or call 0303 123 1113.

Changes to this notice

We’ll update this notice if anything changes. This version is dated [date].

What a privacy notice must tell people

UK GDPR gives everyone the right to know how their information is used. The ICO says your notice must cover:

who you are and how to contact you
why you use people’s information, and your lawful basis for each use
who you share it with, and whether it leaves the UK
how long you keep it
people’s rights, including the right to complain to the ICO
whether people have to give you information, and what happens if they don’t

The template covers every item on the ICO’s list that’s likely to apply to a church.

Why a church notice is different

Being on a church’s records says something about a person’s faith. The law treats that as special category information, and a template written for a shop or a club won’t mention it.

This template explains the condition most churches rely on, for religious not-for-profit bodies. It covers members, former members and people in regular contact, as long as you don’t share their details outside the church without consent. Our GDPR guide for churches explains it in more detail.

How to make it yours

Add your church’s details in the boxes above. Anything you leave blank stays highlighted in yellow in the Word file.
Read every section, and delete anything you don’t do. If you don’t take photos, take that line out.
Add anything the template misses, such as a nursery, a café or hall bookings.
Check which suppliers you use, such as your email service, and where they store information.
Delete the notes for your church, then ask your trustees or church council to approve the notice.

Where to put it

Publish it on your website, and link to it from every form that collects details, such as online giving and event sign-ups. Put a printed copy on the noticeboard too.

When you collect details on paper, such as a welcome card, say where people can read the notice. Give a copy to anyone who asks.

Mistakes to avoid

Saying you rely on consent for everything. People can withdraw consent at any time, which doesn’t fit records you must keep, such as Gift Aid records.
Leaving out HMRC. If you claim Gift Aid, say that you share givers’ details with HMRC.
Putting it somewhere nobody can find it. A notice only works if people can read it when they give you their details.
Letting it go out of date. Review it every year, and whenever you start using information in a new way.

If you send news or appeals by email, check when you need consent. The charity soft opt-in may let you email some supporters without it.

Questions churches ask

Does a small church need a privacy notice?: Yes. Any church that keeps information about people must tell them how it’s used, whatever its size.
Do we need consent to keep members’ details?: Usually not. Most churches rely on legitimate interests and the condition for religious not-for-profit bodies. You need consent for things like photos online, sharing details outside the church and most email news.
Is a privacy notice the same as a data protection policy?: No. A privacy notice is for the people whose information you keep. A data protection policy is for your team, and says how you look after information. A retention policy is one part of it.
Is this template legal advice?: No. It’s based on ICO guidance, but your church is responsible for making sure its notice is accurate. If you’re unsure, ask your denomination or an adviser.

Sources

This template follows official guidance. It isn’t legal or tax advice, so check anything you’re unsure about with HMRC, the ICO or an adviser.

Make the promises in your notice easy to keep

Church Member Software shows each role only the records it needs and tracks requests against their deadlines. It lists who’s due for removal under your own retention periods, and stores everything in the UK.

Start your free trial See prices