How much personal data a church really holds
A church holds more personal data than almost any other membership organisation: membership registers, giving and tithe records, baptism and marriage records, cell group and home-fellowship lists, pastoral counselling notes, congregation photographs, and WhatsApp broadcast lists. Each of these names identifiable people, and each is personal data under the Act — whether or not the church calls it that.
Some of it is special personal information
Religious belief, health disclosed in counselling, and the data of children are special personal information, which the Act protects with stricter conditions. A pastoral note about a member's illness, or a child's Sunday-school register, is not ordinary personal data. It carries a higher duty of care and a narrower set of things you may do with it.
Religious organisations are in the first inspection group
POTRAZ has named religious organisations among the priority sectors it will inspect first from 1 September 2026. That means a church is not an afterthought in this regime; it is near the front of the queue.
What a compliant church looks like
A compliant church has a written register of what personal data it holds and why; privacy notices given to members when they join; consent recorded where consent is needed (photographs, broadcast lists); a retention approach so that old records are not kept indefinitely; controls on who can see counselling notes; and a named, appointed Data Protection Officer.
Three things to fix this month
First, move giving records and pastoral notes off shared, password-free drives. Second, stop publishing congregation photographs without consent. Third, put the DPO appointment in writing.
Sources: Cyber and Data Protection Act 5 of 2021 [Chapter 12:07]; Statutory Instrument 155 of 2024; POTRAZ inspection announcement (1 September 2026).
This is general guidance, not legal advice. Your licence category is determined by POTRAZ on assessment of your application.