GDPR guidance for churches and synods
Guidance to help churches comply with the General Data Protection Regulation (GDPR) that came into force on 25 May 2018. It cannot cover comprehensively everything that any church might ever do with data but churches following this advice should be well on their way to compliance.
Contact the for more information and advice.
Hints and tips for good data protection practice
- Respect everyone鈥檚 privacy.
- Ensure that paper records are kept in a locked cupboard.
- Do not disclose any personal information about an individual without first obtaining that person鈥檚 consent 鈥� that includes, address, telephone number, email address, age,聽 birthday, names of family members.
- When emailing groups of people always put their email addresses in the 鈥榖cc鈥� row rather than the 鈥楾o鈥� row. This prevents an individual鈥檚 email address being visible to all the recipients
- If you are sharing birthday information (age or date) about an individual with others always ask for the individual鈥檚 permission first. Ideally this should be in writing.
- When mentioning pastoral concerns or praying for identifiable individuals take reasonable steps to ensure that the individual (and anyone else who may be directly or indirectly
involved) is willing for this to happen. - When minuting pastoral concerns, refrain from mentioning names and the nature of the concern.
- Prayer lists should be confidentially destroyed immediately after they have been used.
- Personal data held on laptops, data sticks and other portable electronic devices should be
encrypted. - If using cloud storage ensure that the servers are located within the European Economic Area (EEA) and take reasonable steps to ensure security.
- Order your records 鈥� minimise what you keep.
- Check that existing and former officers/elders/committee members are not retaining their own copies of personal data in paper form or electronically. Seek their confirmation that聽 all such data has been returned or destroyed.
Useful resources and templates
Please download and use our checklist and templates:
- Checklist for establishing good data protection practice in your church (Word | 31kb)
- Data privacy statement template for churches (Word | 46kb)
- Data privacy statement consent template for churches (Word | 27kb)
- Church committee membership undertaking template (Word | 37kb)
- Church committee membership leaver declaration template (Word | 34kb)