A group for each ministry, one for announcements, another for prayer: for many churches, WhatsApp has become the default management tool. No decision, no setup — and nobody asking where the information posted there ends up.
The gist in 20 seconds: WhatsApp is an excellent channel and a very poor register. For announcing, coordinating, encouraging: keep it — it does the job better than any software. For keeping the member list, following up with people and collecting sensitive requests: it is a real legal and pastoral risk, because nothing in it is compartmentalized, traceable or erasable.
There is no point demonizing the tool your whole congregation already uses. WhatsApp has qualities no church software will ever match:
None of this should be thrown away. The question is not "should we stop using WhatsApp?" but "how far can we trust it with information about people?"
In a group, every participant sees and can save everyone else's number. Adding eighty people to "Church — news" means distributing the congregation's phone directory to eighty people who never asked for it. A phone number is personal data, and sharing it requires, at the very least, informing the people concerned.
"Let's pray for Marie, who is in hospital this week": a harmless sentence which, legally, is the disclosure of health data to an entire group. The GDPR places this information among the most protected categories of data and requires explicit consent. In a group, there is no documented consent, no way to limit distribution and no way to prevent a screenshot.
Software lets you say: the board sees the list, only the pastor sees counseling notes. WhatsApp knows just one rule: whoever is in the group sees everything, including the message history depending on the settings. There is no way to hold pastoral follow-up there without exposing people.
The thread moves up, and the information goes with it. Who said this family needed a call back? In which group? Three weeks ago or six? Pastoral care requires being able to find a piece of information months later, which a messaging app does not allow.
When a leader steps away, they leave with the complete history on their phone: numbers, confidences, conversations. The church, meanwhile, gets nothing back. It is a double penalty: lost memory for the congregation, and personal data lingering with someone who no longer has any reason to hold it.
A member asks for their data to be erased. On WhatsApp, you can neither find it nor delete it from the other participants' phones. A legal obligation you simply cannot meet is, in itself, a sign that it is time to change tools.
If a member asked you tomorrow, "what information does the church hold about me, and can you erase it?", could you answer? If the answer depends on what is lying around in eight groups and on five phones, you have your answer.
Worth noting: the two tools work very well together. Ministeo's assistant can draft a personalized message from a member's record, which you then send via WhatsApp — the channel stays the one people use, while the sensitive information stays protected.
Is it illegal to use WhatsApp in a church?
No. WhatsApp is a perfectly usable communication channel for announcements and coordination. The problem is using it as the church's database: member lists in groups, detailed prayer requests, pastoral follow-up in chat threads. It is not the tool that is at fault, it is how it is used.
Does creating a WhatsApp group expose members' phone numbers?
Yes. In a group, every participant sees everyone else's number and can save or reuse it. Adding eighty people to a group amounts to handing all of them the congregation's phone list, without asking anyone's permission.
Can you share a prayer request in a WhatsApp group?
This is the most delicate case. A prayer request that mentions an illness, a bereavement or a hospital stay is health data under the GDPR. Posting it in a group of a hundred people means disclosing it to a hundred recipients without explicit consent, with no way to withdraw it and no control over it being passed on. Always ask for the person's consent, and share the bare minimum.
What happens when a leader leaves the church?
With WhatsApp, they keep on their phone the history of every conversation, everyone's numbers and the personal information exchanged. The church association has no way of retrieving or erasing any of it. It is a loss of memory for the church and a data leak for the members.
Can a member ask for their data to be erased on WhatsApp?
In practice, it is impossible to guarantee. The right to erasure assumes you can find all of a person's data and delete it. In chat threads spread across the phones of dozens of participants, nobody can honestly commit to that — which is one of the reasons WhatsApp cannot serve as a register.
What is the right split between WhatsApp and church software?
A simple rule: WhatsApp is a channel, not a register. What is short-lived and collective (announcements, Sunday coordination, encouragement) belongs there. What needs to last, be found again or stay confidential (member records, follow-up, counseling notes, sensitive requests) must live in a tool designed for it.
This article is an educational summary written by the Ministeo team based on public texts (the GDPR, recommendations from the CNIL — the French data protection authority — and French law on associations). It does not constitute legal advice: for a specific situation, contact your church federation, a lawyer or your association's data protection officer. Spotted an inaccuracy? Write to us: contact@ministeo.com.
Member records, follow-up and encrypted confidential notes in a tool built for the job — and messages you still send via WhatsApp. Free up to 50 members.
Get started for free