Skip to main content
Church Member Software

Subject Access Request Response Letter Template for Churches

Someone has asked what your church holds about them, and the one-month clock is running. This reply letter covers everything the ICO says to send with their information, in plain English.

  • Free
  • No sign-up
  • Word and PDF
  • Updated 19 October 2026

A starting point, not legal advice. Check it matches how your church works, and ask your denomination or an adviser if you’re unsure.

1. Add your church’s details

Optional. What you type goes straight into the document. It stays on your computer and isn’t sent to us.

For example, “Jane Smith, Church Administrator”.

2. Download or print

Download Word file

The Word file opens in Microsoft Word, Google Docs, Apple Pages and LibreOffice. Or download the blank PDF.

Preview

[Church name]

[Date]

Dear [Name],

Your request for a copy of your information

Thank you for your request, which we received on [date]. We’ve searched our records and enclose a copy of the personal information we hold about you.

We searched [our church management system, email, paper files and our notes of pastoral contact].

Note for your church: List where you looked. A reasonable and proportionate search is enough, but include email, phones and paper as well as your main records. This note isn’t printed, and you can delete it from the Word file.

About your information

What we hold: [your contact details, your involvement in church life and records of your giving and Gift Aid declarations].

Why we use it: [to keep in touch about church life, organise services, groups and rotas, care for you pastorally and claim Gift Aid on your gifts]. Our privacy notice explains our lawful basis for each use.

Who we share it with: [HMRC, when we claim Gift Aid, and the companies that provide our church management software and email service].

Whether it leaves the UK: [We don’t send it outside the UK.]

How long we keep it: [as set out in our data retention policy, which is enclosed].

Where it came from: [from you, unless we’ve noted otherwise].

We don’t make decisions about you using computers alone.

Anything we haven’t included

[We’ve removed information about other people, as we’re required to protect their privacy too.]

Note for your church: If you’ve held anything back, say what kind of information and why. Delete this section if you haven’t. Get advice before withholding anything else, especially safeguarding records. This note isn’t printed, and you can delete it from the Word file.

Your rights

You can ask us to correct anything that’s wrong, delete information we no longer need, limit how we use it or object to how we use it. Contact us at [email address].

If you’re unhappy with how we’ve handled your request, please tell us first. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

Yours sincerely,

[Your name and role]

[Church name]

When a request arrives

A request doesn’t have to use the right words. “What do you have on me?” in an email, a phone call or a chat after the service is a subject access request. Anyone at the church can receive one, so make sure your team knows who to pass it to.

Write down the date it arrived. You have one month to reply. Only ask for proof of identity if you genuinely need it, and if you do, the month starts when you get it.

Searching your records

Your search needs to be reasonable and proportionate. Check your main records, email, phones and paper files, and any notes kept by your minister or pastoral team.

If the request is unclear or you hold a lot about the person, you can ask them to narrow it down. The clock pauses on the day you ask and starts again the day after they reply.

Other people’s information

Church records often mention other people: a prayer request about a family member, or a note of a conversation. You don’t have to share someone else’s details unless they agree, or it’s reasonable to share them anyway.

Remove or cover what you can’t share, and say in your letter that you have.

What to send

Send a copy of the information itself, not a summary, with a letter explaining it. The ICO calls this supplementary information: why you use it, who you share it with, how long you keep it, where it came from and the person’s rights. The template covers all of it.

If they asked by email, reply by email in a format they can open. Send it securely, and check the address before you press send.

Safeguarding records and refusals

Some information can be held back under exemptions, but only case by case, and with a reason you’ve written down. Safeguarding records need particular care.

If you’re thinking of withholding anything beyond other people’s details, ask your denomination, safeguarding lead or an adviser first.

If you refuse all or part of a request, tell the person why, and that they can complain to you and to the ICO. Our GDPR guide for churches has more on people’s rights.

Questions churches ask

How long does a church have to answer a subject access request?
One month from receiving it. You can extend by up to two more months for a complex request, as long as you tell the person why within the first month.
Can we charge for answering a request?
Usually not. You can only charge a reasonable fee if a request is manifestly unfounded or excessive, or for extra copies.
Do we have to include pastoral notes?
They’re covered by the request, so you must search them. You may need to remove details about other people, and some information can be held back under exemptions. Get advice if you’re unsure.
What if a parent asks for their child’s information?
The information belongs to the child. If the child is mature enough to understand their rights, respond to them. Otherwise a parent can usually act for them, as long as it’s in the child’s best interests.

Read next

Sources

This template follows official guidance. It isn’t legal or tax advice, so check anything you’re unsure about with HMRC, the ICO or an adviser.

Answer the next request in one click

Church Member Software tracks each request against its deadline and downloads everything you hold about the person as one file. Private notes, such as pastoral ones, are listed for someone to check by hand first.

Start your free trialSee prices