GDPR for parishes: a practical guide for the parish office

Every parish holds information about people: names and phone numbers of parishioners, sacramental registers, volunteer rotas, the lists kept by the Philoptochos. The General Data Protection Regulation (GDPR) applies to all of it. There is no need to be afraid of the regulation; we simply need to understand it and organise our work with respect for the people who trust us with their details.

Please note: this article is general information, not legal advice. For specific questions, contact your national data protection authority (in Greece, the Hellenic Data Protection Authority), a lawyer, or your diocese.

Why parish data is special

The regulation requires a lawful basis for every use of personal data (Article 6). On top of that, Article 9 treats religious beliefs as a special category of data that needs stronger protection. For a parish this matters in practice: the mere fact that someone is on the parish register, was baptised, or asked for a memorial service says something about their faith. The regulation does make specific provision for religious bodies dealing with their own members, but that does not mean the information can travel freely outside the community.

Keep only what you need

Data minimisation is perhaps the most useful principle for a parish office. Before adding a field to a form, ask: why do we need this? To send greetings, a name and one way of getting in touch are enough. Tax numbers, marital status or occupation are rarely needed. Less data means less risk and less work keeping it up to date. Our guide to the parish member register looks at which details are genuinely worth recording.

Consent and clear information

When parishioners hand over their details, they should know what will happen to them. A short, readable notice on the registration form is a good start: who holds the information, for what purpose, for how long, and how to ask for a correction or deletion. For anything beyond the basic pastoral relationship, such as newsletters, photographs on social media or publishing names, ask for separate, explicit consent and keep a written record of it.

Who has access

Not every volunteer needs to see everything. The person running the choir needs the choir's phone numbers, not the Philoptochos lists. Set out clear roles:

• The parish priest and the parish secretary can see the register.
• The treasurer sees donations and receipts.
• Group leaders see only the members of their own group.
• When someone steps down from a ministry, their access ends.

How long to keep information

Sacramental registers are permanent records and follow the rules of the Church. Other information has a natural end date: the sign-up list for a pilgrimage, parents' phone numbers from a Sunday school class years ago, assistance requests that have long been closed. Pick one time each year, September works well, to review what can safely be deleted, and keep a simple note of what you hold and for how long.

When a parishioner asks about their data

Everyone has the right to know what information the parish holds about them, to ask for corrections and, in many cases, to ask for deletion. Treat such requests courteously and without delay. It helps to agree in advance who in the office handles them and where all of a person's details are kept. If information is scattered across notebooks, mobile phones and spreadsheets, giving a clear answer becomes difficult.

Storing data safely

A lockable cupboard for paper records, a password on the office computer, regular backups, and no files of parishioner details sitting in personal email accounts or on USB sticks that go missing. If you use online services, prefer providers that store data within the European Union and explain clearly how they protect it.

Take care with group chats and lists

This is where most mistakes happen, usually with the best of intentions. A Viber or WhatsApp group with a hundred parishioners shows everyone's phone number to everyone else. An email to many people with all the addresses in the "To" field reveals who is on the list. A name-day list posted publicly or sent to the whole parish may reveal more than someone would like. Use blind copy, announcement channels where only administrators can post, and ask before publishing names. Our guide to parish communication goes into this in more detail.

A small plan to get started

Write down where you hold personal information today. Remove what you do not need. Decide who sees what. Draft a short notice for parishioners. Set an annual review date. None of this has to happen at once; every step makes the parish safer and more trustworthy.

Convivia is being designed with access roles and European data storage, so that parish records stay tidy and protected. Explore the features.