GDPR in a church: religious data (article 9) without the fear
- GDPR
- Privacy
30-second summary
- Knowing that someone belongs to a church reveals their religious beliefs. The GDPR treats this as a special category of data (article 9).
- The GDPR covers your case: a non-profit religious body may process data on its members, former members and people in regular contact, as long as it does not share it outside without consent (article 9(2)(d)).
- For visitors and for more sensitive data, such as prayer requests mentioning health, ask for explicit consent.
- If there is a data breach, notify the Portuguese authority (CNPD) within 72 hours (article 33).
For churches in Portugal.
Yes, your church has to comply with the GDPR, and the member list is sensitive data. But that is no reason for fear: the GDPR expressly provides for religious organisations. If you only process data on members, former members and people in regular contact, do not disclose it to third parties without consent, and follow a few simple rules, you are on the right track.
Why a church’s data is special
Article 9(1) of the GDPR prohibits, as a rule, processing data that reveals religious or philosophical beliefs. A member list says, by its very existence, what each person believes. A prayer request can also reveal health, which is another special category. So what would be a plain contact database in a company needs more care in a church.
The exceptions that matter to you
Article 9(2) provides exceptions. Two are central:
- Explicit consent (point a). The person clearly says they agree, for a specific purpose.
- Non-profit bodies with religious aims (point d). You may process data in the course of your legitimate activities and with appropriate safeguards, if the processing relates solely to members, former members or people who have regular contact with you, and if the data is not disclosed outside without the individuals’ consent.
On top of the article 9 exception, you need a legal basis under article 6, such as consent or the church’s legitimate interest.
What data do you actually hold?
Make a list, even on one sheet of paper. The GDPR calls it a record of processing activities (article 30). The exemption for organisations with fewer than 250 employees does not apply to those who process special categories of data, so a church should keep this record. Think of:
- the member record (contacts, family, dates);
- attendance, rotas and group participation;
- donations and donors’ tax numbers;
- prayer requests and pastoral notes;
- photos and videos of services;
- children and parental authorisations (allergies, health).
The basis, case by case
| Who or what | Most suitable basis |
|---|---|
| Members, former members, regular contacts | Article 9(2)(d), with safeguards |
| Visitors who fill in a card once | Explicit consent, simple and separate |
| Donors (tax number, amounts) | Legal obligation to keep a register (EBF article 66) |
| Prayer requests with health information | Explicit consent from the writer; limited visibility |
| Children | Authorisation from whoever holds parental responsibility |
On children, the age at which a minor can consent alone to online services varies from country to country: article 8 of the GDPR sets 16 and lets each Member State lower it to as low as 13. Check the age in force in Portugal with the CNPD or a lawyer.
Who sees what
Give each person the minimum they need. The treasurer does not need to see prayer requests. A cell leader does not need to see donations. Never export the full list to a messaging group. Reviewing access twice a year is enough.
What to tell people
Write a privacy notice in plain language: who you are, what data you keep, why, for how long, who you share it with (for example, your software provider) and who to contact to exercise rights such as access (article 15) and erasure (article 17).
If something goes wrong
Lost a phone with the list? Sent a list to the wrong person? That is a personal data breach. Notification to the CNPD must be made within 72 hours of becoming aware, through the form on the CNPD website. If the risk is high, tell the people affected too. And record every breach internally, even those you do not report.
If your community already has its own rules
Article 91 allows churches and religious communities that were already applying a comprehensive set of data protection rules when the GDPR entered into force to keep applying them, provided they comply with the regulation and remain subject to the supervision of an independent authority.
An eight-step plan
- List the data you keep.
- Define who can see what.
- Choose the basis for each processing activity.
- Write the privacy notice.
- Ask for explicit consent from visitors and for sensitive data.
- Sign a processor agreement with your software provider (article 28).
- Agree how to answer access and erasure requests.
- Prepare what to do in a breach and who tells the CNPD.
What about Brado?
Brado was designed with role-based access (the treasury does not need to see prayer requests), consent records and an export of each person’s data. The GDPR remains the church’s responsibility, but it helps to have tools that do not pull you the other way. Your data stays in the EU. See the plans on Pricing and the rest on Platform. If you are comparing providers, use the checklist for choosing software.
This is general information, not legal advice.