GDPR for churches: a practical guide for the church office
The GDPR is Europe's data protection law, and it applies to churches too. Simply being on a church's register reveals a religious belief, a kind of data the law protects in a special way. This guide sums up the essentials and is not a substitute for advice from a lawyer.
Why a church register is sensitive data
Article 9 of the GDPR forbids, as a rule, processing data that reveals religious beliefs, and lists the exceptions. Two of them matter to a church: the person's explicit consent, and processing by a not-for-profit body with a religious aim, about its own members, without passing the data to others without their consent. Visitors and occasional contacts call for extra care.
What the church should do
- Decide who is responsible for data at the church.
- Ask only for the data it will actually use.
- Record when and how each person gave consent.
- Limit who sees what: the treasurer doesn't need the whole register.
- Keep data somewhere secure, not in loose spreadsheets or messaging groups.
- Decide how long each kind of data is kept.
- Have a contract with anyone who processes data on the church's behalf, such as the software supplier.
Each person's rights
Anyone can ask the church for:
- A copy of the data the church holds about them.
- Correction of anything that is wrong.
- Erasure of their data, within the legal duties to keep records.
- Withdrawal of their consent, as easily as they gave it.
Children and young people
When processing is based on consent, a child's data depends on the authorisation of whoever has parental responsibility. The minimum age to consent to online services varies between countries, from 13 to 16. If in doubt, record the parent's or guardian's authorisation.
Church e-mails and messages
Ask for a separate permission, apart from the register, to send messages, and offer an easy way to opt out in every one.
If data leaks
A breach that puts people at risk must be reported to the data protection authority within 72 hours of the church becoming aware of it. When the risk is high, the people affected must be told as well.
How Atrium helps
In Atrium, the data is stored in the European Union. The register records consent with the date and how it was given, each role sees only what it needs, and copying or erasing a person's data takes a few clicks.
Frequently asked questions
Does the GDPR apply to small churches?
Yes. The regulation doesn't exempt organisations because of their size when they keep people's data in an organised way.
Can the church publish a list of birthdays?
Only with the people's permission. Name and date of birth are personal data, and appearing on a church list reveals a link with the church.
Can we keep members' details in a spreadsheet?
The law doesn't ban the tool, but it does require security and access control, which are hard to guarantee in a loose file.