GDPR in a church: what you really need to do

For churches in Portugal.

Your church has to comply with the GDPR even if it is small, because a member list reveals religious beliefs, and article 9 of the regulation treats that as a special category of data. The good news is that the essentials come down to seven concrete actions, explained below. This text is general information and does not replace legal advice.

What the GDPR asks of a church, in two ideas

First idea: processing data that reveals religious beliefs is, as a rule, prohibited (article 9(1)), unless an exception applies. Second idea: the regulation has an exception designed for you. A non-profit body with religious aims may process data on its members, former members and people who have regular contact with it, with appropriate safeguards, as long as it does not disclose the data to third parties without the individuals’ consent (article 9(2)(d)).

Article 91 adds that churches that already had a comprehensive set of data protection rules when the GDPR came into force may keep applying them, if they bring them into line with the regulation.

Everything else is method. Here is an order of work.

The seven essential actions

1. Take an inventory of your data

Write down what you keep, why, who sees it, where it is and until when. A simple table is enough. The GDPR calls it a record of processing activities (article 30), and the exemption for organisations with fewer than 250 employees does not apply to those who process special categories of data.

Data	Why	Who sees it	Where it is	Until when
Member record	Contact and support	Office, pastors	Church system	While they are a member
Donations and NIF	Receipts and tax return	Treasury	Church system	Legal period
Prayer requests	Pray and support	Care team	Church system	Until answered
Photos of services	Publicity	Communications	Shared folder	To be set

If the “where it is” column has five different places, you have already found the first problem.

2. Limit who sees what

The treasury does not need to see prayer requests. A cell group leader does not need to see donations. Give each person the minimum to do their job and avoid sending the full list to a messaging group. Review access twice a year, or whenever someone joins or leaves a team.

3. Choose the right basis for each group of people

There is no single basis for everyone. In broad terms:

• Members, former members and regular contacts: the article 9(2)(d) exception, with safeguards.
• Visitors: explicit consent, simple and separate, for a clear purpose (for example, contacting them after the visit).
• Donors: the legal obligation to keep a register of who gives, for the receipt and the tax return. See the Modelo 25 guide.
• Health data in prayer requests: explicit consent from the person writing, with limited visibility.

The guide to GDPR in a church details each case and the conditions of each exception.

4. Inform people

Write a privacy notice in plain language. Say who you are, what data you keep, why, for how long, who you share it with (for example, the management software provider) and who people should contact to exercise their rights. One page is enough. Put it on the visitor card, on the website and in the app.

5. Choose suppliers carefully

The management software, the email service and the file storage process data on your behalf. Article 28 requires a contract that sets out what they may do with it. Before signing, ask where the data is, who else can access it and whether you can export everything when you want to leave. The guide to choosing church management software has these questions and others.

6. Treat children with extra care

Children’s records, permissions, allergies and photos need the permission of whoever holds parental responsibility. Collect only what the children’s ministry needs, and give access only to those who work with the children.

7. Prepare your response to a data breach

A lost phone with the list, a sheet sent to the wrong person, a shared account accessed by someone who should not have: all of these can be a data breach. If there is a risk to people, notification to the CNPD must be made without undue delay and, where feasible, within 72 hours of becoming aware (article 33). If the risk is high, tell the people affected too. Record every breach in writing, even those you do not report.

Decide today who does what. An emergency is a bad time to find out the rule.

Do I need a data protection officer?

A data protection officer (DPO) is mandatory when the core activities consist of large-scale processing of special categories of data (article 37(1)(c)). The regulation does not say how many people count as “large scale”. In a small local church, that will not usually be the case. In a denomination with many thousands of people, the conversation is different.

Even when it is not mandatory, it is worth naming someone responsible internally. Someone who knows where the inventory is, receives requests from people and knows whom to call in a breach. If you are unsure whether you need a DPO, the CNPD has a guidance page on the subject.

What you do not need to do

Some fears lead churches to do too much, or nothing at all.

• Ask every member for consent for the internal list. For members, former members and regular contacts, the regulation allows the article 9(2)(d) exception, with safeguards.
• Delete everything to be safe. Some data the law requires you to keep, such as the donor register. Deleting what you should keep is a problem too.
• Buy an expensive solution. What protects your members is clear rules, limited access and follow-through. A tool helps, but does not replace that.

When to ask for help

Call a lawyer, your denomination’s data protection officer, if there is one, or the CNPD when:

• you are unsure about the legal basis for a new kind of processing;
• you are going to share data with the denomination, another church or an outside body;
• you process health data, children’s data or video images on a large scale;
• there has been a breach that puts people at risk.

The GDPR provides for fines that can reach 20 million euros for the most serious infringements (article 83(5)). Article 83(2) requires, among other factors, the gravity of the infringement and the measures taken to mitigate the damage to be weighed. Showing care is worth more than hoping nobody notices.

How Brado helps

The GDPR remains the church’s responsibility, but a good tool helps you comply. Brado gives access by role, keeps consents, lets you export a person’s data when they ask for it and has a prayer wall with anonymous requests. Your data stays in the EU. On the security page we say what we do and what is still missing.

If you are organising your member list, the article how to organise church members without spreadsheets shows the way. See the rest on the platform page.

This is general information and does not replace legal advice.