A church membership file is not an address book: under the GDPR, it is one of the most sensitive kinds of processing an association can carry out. Here is what is allowed, what is not, and the few habits that are enough to stay compliant.
This guide covers French law: the GDPR as applied in France, the recommendations of the CNIL (the French data protection authority) and French rules on associations. Legal terms are given in French in parentheses the first time they appear.
Three things to remember: 1. the party responsible for the file is the church, not the software vendor. 2. A church membership file inherently contains sensitive data: simply being listed in it reveals a religious belief (Article 9 of the GDPR). 3. An exemption exists for religious bodies (Article 9(2)(d)), but it is narrow: it falls away as soon as data leaves the church, as soon as health is involved, and as soon as there is automated profiling.
This is the first question, and many associations get it wrong by assuming the software vendor carries the responsibility.
In practical terms: if there is a complaint or an inspection, it is the association that answers. Good software does not exempt you from your obligations — but it should give you the means to meet them: export, deletion, traceability, retention periods.
Article 9(1) of the GDPR sets out a prohibition in principle: you do not process data revealing a person's religious beliefs. Yet that is exactly what a church membership file does, by design — even if it contains only a name and a phone number. Membership itself is the sensitive information.
And the file often goes further: stage of spiritual growth, group participation, prayer requests, meeting notes. In other words, a church membership file is one of the most sensitive kinds of processing a small association can handle — often without realizing it.
The GDPR provides a way out, precisely so that religious, philosophical, political or trade-union associations can function. Article 9(2)(d) allows sensitive data to be processed by a not-for-profit body with a religious aim, under two cumulative conditions:
The text also requires "appropriate safeguards": security, restricted access, controlled retention periods.
Three blind spots — and they are precisely the most common ones in the real life of a church:
1. Data leaving for a third party. Exporting your member list to an emailing tool or an external platform means disclosing data outside the body: the exemption falls away and consent becomes necessary.
2. Health data. A prayer request that mentions an illness, a bereavement or depression is health data (Recital 35). It requires explicit consent, not the religious exemption.
3. Automated profiling. An engagement score, automatic detection of "members at risk of disengaging": these are automated decisions within the meaning of Article 22, which call for transparency, consent and a right to object.
| Processing | Possible legal basis | Consent required? |
|---|---|---|
| Membership file, day-to-day management | Legitimate interest (Art. 6(1)(f)) + Art. 9(2)(d) exemption | No, if the exemption's conditions are met |
| Internal communication (meeting notices, news) | Legitimate interest | No, with a right to object |
| Sending to an external emailing tool | Consent (Art. 6(1)(a)) | Yes |
| Prayer requests of a medical nature | Explicit consent (Art. 9(2)(a)) | Yes |
| Confidential pastoral notes | Art. 9(2)(d) exemption + enhanced safeguards | No, but access strictly restricted |
| Engagement score, automated suggestions | Consent + information (Art. 21 and 22) | Yes, with the option to refuse |
| Tax receipts and donation accounting | Legal obligation (Art. 6(1)(c)) | No |
Indicative table: the legal basis always depends on the actual context of the processing in your association.
The principle (Article 5(1)(e)) is simple: no longer than necessary. For associations, the CNIL recommends three years from the end of membership. Here is a working grid you can reuse:
| Data | Active database | Then |
|---|---|---|
| Record of an active member | Duration of membership | 3 years after leaving, then deletion |
| Member who has become inactive | 6 months | Archived for 3 years |
| Ordinary pastoral notes | Duration of membership | 1 year after leaving |
| Confidential pastoral notes | Duration of membership | Deleted immediately on leaving |
| Prayer requests | 2 years, or answered + 6 months | Deletion |
| Pastoral appointments | Duration of membership | 1 year, anonymized |
| Access and change log | 3 years | Archived for 2 years |
| Proof of consent | 5 years after the last processing | Archived for 5 years |
Every member can exercise rights, and the association must respond within one month. In practice, be ready for four kinds of request:
Many associations believe they are exempt because they have fewer than 250 people. That exemption does not apply when the processing involves sensitive data — so it never applies to a church membership file.
Rest assured: this record of processing activities (registre des traitements) is an internal document, not an administrative filing. For each processing activity, note the purpose, the categories of data, the legal basis, who has access, the retention period and the security measures. A few pages are enough. Not to be confused with the list of members — see our dedicated page on the membership register of a religious association.
Is a church allowed to keep a file of its members?
Yes. In principle, the GDPR prohibits processing data that reveals religious beliefs (Article 9(1)), but Article 9(2)(d) provides an exemption for not-for-profit bodies with a religious aim. It applies under two cumulative conditions: the processing relates solely to members, former members or people in regular contact with the church, and the data is not disclosed outside the body without the consent of the people concerned.
Who is responsible for the file: the church or the software vendor?
The church. It is the data controller within the meaning of Article 4(7) of the GDPR: it decides why and how the data is processed. The software vendor is a processor (Article 4(8)) acting on instructions. If the CNIL carries out an inspection, it is the association that answers — which is why it matters to choose a tool that helps you meet your obligations.
Do members have to consent to being in the file?
Not always. Routine administrative management of members can rely on the association's legitimate interest or on the Article 9(2)(d) exemption. However, explicit consent becomes necessary again in three cases: passing the data to a third party (an emailing tool, an external platform), processing health data, and setting up automated profiling.
How long should a former member's data be kept?
For associations, the CNIL recommends a period of three years from the end of membership. Beyond that, the data must be deleted or anonymized. Pastoral notes, which are more sensitive, deserve a shorter period — and confidential notes should be deleted when the person leaves.
Can a prayer request be health data?
Yes, very often. Recital 35 of the GDPR includes in health data any information from which a person's physical or mental health can be inferred. A prayer request mentioning an illness, a bereavement, a hospital stay or depression is health data and falls under the enhanced protection of Article 9.
Does a small church need to keep a record of processing activities?
Yes. The exemption for organizations with fewer than 250 people does not apply when the processing involves sensitive data — which is inherently the case for a church membership file. This record is a simple internal document: what data, for what purpose, on what legal basis, for how long, and who has access.
What should you do if a member asks for their data to be erased?
You must respond within one month. Erasure must be complete and also cover related items: notes, prayer requests, history. Some data may be kept if a legal obligation requires it — typically accounting records linked to a donation. Check that your software allows genuine deletion, not just hiding.
This article is an educational summary written by the Ministeo team based on public texts (the GDPR, CNIL recommendations, French law on associations). It does not constitute legal advice: for a specific situation, contact your church federation, a lawyer or your association's data protection officer. Spotted an inaccuracy? Write to us: contact@ministeo.com.
Confidential notes encrypted one by one, differentiated access rights, one-click export and complete deletion, hosting in France. Free up to 50 members.
Get started for free