Practical guide
What data protection laws mean for churches
Practical privacy principles for member records, contributions and pastoral care, from LGPD to GDPR and US state laws.
Churches also process personal data
Records, lists, registrations and contributions involve personal data. Religious and health information may require stronger protection.
Map purpose and access
Document why each piece of data is collected, who needs to access it and how long it should be kept.
Prepare for rights and incidents
Have a channel for requests, correction and deletion procedures and a plan to respond to security incidents.
Religious data requires stronger care
Religious belief is treated as sensitive personal data. Prayer requests, counseling notes and health information should have minimal collection, restricted access and a documented purpose.
Consent is not the only legal basis
Depending on the processing activity, other legal bases may apply. What matters is documenting the decision, informing people clearly and keeping the process documented.