GDPR consent form for the church membership register

The form a member signs to let the church keep their details in the register. In plain language, it explains what the church keeps, why, for how long, and how to ask for a copy or for the data to be erased.

Download in Word (.docx)

Free, no sign-up. Opens in Word, LibreOffice, Pages and Google Docs.

This template is a starting point, not legal advice. Review the text with the church leadership, ideally with a lawyer, and adapt it to the data the church actually keeps and how it uses it.

This template is a starting point, not legal advice. Review the text with the church leadership, ideally with a lawyer, and adapt it to the data the church actually keeps and how it uses it. Delete this note before use.

Consent form for the church membership register

Who looks after your data

[Church name], registered no. [number], based at [address]. For anything about your data, contact [name or role] by email at [email] or by phone on [phone].

What data we keep

Identity and contact details: name, date of birth, address, phone and email.
Family: spouse and children who are also part of the church.
Church life: the date you joined, the date and place of your baptism and the ministries you serve in.

Being on a church's register reveals a religious belief. That is why the law gives this data special protection (Article 9 of the General Data Protection Regulation, the GDPR), and why the church asks for your explicit consent.

What we use it for

Keeping the church's membership register.
Contacting you about church life, such as notices and calls to members' meetings.
Issuing the letters and certificates you ask for.

We do not sell your data or pass it to anyone outside the church without your permission, unless the law requires it. The data is kept in [where: a locked paper file, the system the church uses and the country of its servers], and only [who: for example, the pastor and the church secretary] can access it.

How long we keep it

For as long as you are part of the church. If you leave, we delete your data within [period set by the church], and keep only what the church's historical record needs: [for example, your name and the dates you joined, were baptised and left].

Your rights

At any time, you can ask for a copy of your data, for anything wrong to be corrected, for your data to be erased or its use restricted, and for it to be handed over in a portable format, and you can object to a particular use. You can also withdraw this consent whenever you like, as easily as you gave it: anything done before then remains valid. If you think your data has not been handled properly, you can complain to the data protection authority: [in Portugal, the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt].

Consent

Tick what you agree to. Each box is separate: you can accept the first and decline the others.

I authorise [church name] to keep and use my data above, including data that reveals my connection to the church, for the membership register and to contact me about church life.

I agree to receive occasional messages from the church by email or WhatsApp, such as event notices and a birthday message. (optional)

I authorise the church to publish photos and videos in which I appear on its website and social media. (optional)

Full name

Date

Signature

If the person is under 18, a parent or guardian also signs:

Name of parent or guardian

Signature of parent or guardian

What it is for

Under the GDPR, data that shows a person's connection to a church is special category data (Article 9). To process it, the church needs one of the exceptions the law allows. This template uses the clearest one: the person's explicit consent, in writing.

There is another possible exception for not-for-profit religious bodies, regarding their own members (Article 9(2)(d)). Which one applies to your church is a good question for a lawyer.

Each permission has its own box. The register is one thing; receiving messages and appearing in photos on social media are others, and a person can accept one and decline another.

How to fill it in

Fill in the church's details and the contact for whoever is responsible for the data.
Adjust the list of data to what the church really keeps. If you don't use a piece of data, take it off the list and out of the register.
Write where the data is kept and who has access, and set the period for deleting the data of people who leave.
If the church is not in Portugal, put your own country's data protection authority in the rights section.
Delete the note at the top, print the form and hand it out with the membership form.
Keep the signed form, and note in the register the date and the way consent was given.
If someone withdraws consent, stop using their data and delete what you don't need to keep.

Good practice

Consent only counts if it is freely given: nobody stops being a member for saying no to photos or messages.
The boxes start unticked. The person ticks what they agree to.
For anyone under 18, a parent or guardian signs too.
Keep the forms somewhere locked, or scanned into a system with restricted access.

To learn more, read the guide GDPR for churches: a practical guide for the church office.

Frequently asked questions

Does a church have to ask for consent?

The church needs a legal basis to keep religious data. Explicit consent is the easiest to prove, and it is the one this template uses. There is another possible basis for the members of religious bodies: check with a lawyer which one applies to your church.

Do people already in the register need to sign?

If the church is going to rely on consent, yes. Use the next members' meeting or the next register update to collect the signatures.

Where can someone complain if their data is misused?

To the data protection authority of the country where the church is: in Portugal, the Comissão Nacional de Proteção de Dados (CNPD); in Spain, the AEPD. In the UK, which has its own version of the GDPR, it is the ICO. The template names the CNPD: change it if your church is elsewhere.