Data privacy and our giving ask letters
GDPR. Complex law; important purpose: protecting our privacy and lawfully processing personal data.
General Data Protection Regulations (GDPR) has been with us since May 2018 and all churches must comply. Most of this blog is ‘big picture’ GDPR stuff. It’s about more than our stewardship ministry. It’s about GDPR decisions the church has made or changes we might make to stay compliant with the law.
For the big picture check out the Parish Resources website.
All data processing must be ‘necessary’. If your stewardship programme can work with generic letters and/or your social media and website (not direct, personal emails) there’s no GDPR issue. If you judge personal letters are ‘necessary’, read on. On that big picture GDPR canvas, we’ll paint some stewardship detail: how to stay legal and model good practice with our giving ask letters?
For more detail and practical guidance see Building the Database.
Our privacy policy
When we think GDPR; we think consent. But it’s one of seven lawful bases for processing personal data. For example, we claim Gift Aid under legal obligation. Our focus here is consent and legitimate interests. One, or both, will underwrite our church data processing.
First point: our church privacy policy should state these lawful bases and name ‘fundraising’. It’s a handy, catch-all term, sometimes stated on it’s own; sometimes wrapped with others. Perhaps:
‘to share our news, events and activities and to inform you of the fundraising, stewardship and volunteering opportunities that make possible our worship, ministry, mission’.
Consent as a lawful basis
Consent does what it says on the tin. Individuals give consent for their church to hold and use personal details to communicate about church activities. We have consent; or we don’t. It’s fairly easy to manage, especially with church admin software. Consents can change so, like other charities, review/refresh our consents periodically.
Here’s the thing. In the jargon, consent must be specific, informed and active. That’s why consent forms are ‘layered’; meaning tick box options on how we contact (phone, post, email, text) and what we contact about (e.g. activities, events, fundraising/stewardship).
Fundraising should be named on consent forms. It can be a separate tick box but stewardship is part of church life, like prayer or worship, events and activities. Maybe:
I am happy to be informed about church news, events, activities; fundraising, stewardship, volunteering and other ways I can support our mission.
With our consents in place and reviewed:
we can write differentiated, personal hard copy giving ask letters
we can email a copy of those letters, so long as consent to email is ticked
we must enable the recipient to opt-out of any more electronic comms, if we send an email
we must review our mailing list to ensure pastorally appropriate communications (more below).
Legitimate interests as a lawful basis
Our church may not gather consents, or what we have doesn’t cover everyone we want to write to. Legitimate interests is a second lawful basis. It offers flexibility but we pick up more responsibility and more complexity. Remember: this is big picture GDPR stuff . It’s wider than our stewardship ministry.
(It’s clear: we can’t use legitimate interests to get around someone declining fundraising as a purpose on their consent form).
Every church holds personal data, collected over many years for many reasons. We must have obtained details from the individual, directly. We can’t use the Mother’s Union membership list or ask Bill to get Mary to find Tom’s details. Critically, when we use legitimate interests there’s a three fold test.
An example: All Souls, Anytown has 100 adults regularly in church. The church’s purpose is clear: financial sustainability, personal discipleship. All Souls’ interest in asking is balanced by the interests of 100 adults who value their church and know money makes ministry possible. There’s a shared necessity in All Souls making a personal giving ask and the congregation making a personal, generous response.
Next, the All Souls planning group checked their mailing list. They’ve done this for years. A sensitive, pastoral exercise. They won’t write to an elderly person in hospital or new to a care home; or to a recently bereaved father. They were mindful of the Code of Fundraising Practice guidance on vulnerable people both in the content of their letters and in who letters were sent to. The planning group didn’t know it but they had just done a Legitimate Interests Assessment (LIA). (The formal guidance is here.) As you see, it’s not new in principle and it’s not hard in practice.
Note two other things. For the PCC, the All Souls planning group briefly documented their purpose, necessity and balance decisions and their mailing review conclusions (no personal details, of course). They also decided not to write to 50 adults who took the church magazine but rarely if ever attend church. All Souls. Although obviously interested, they wouldn’t reasonably expect an invitation to regular giving and a magazine article was a less intrusive way to ask. A fabric appeal? Different purpose. Different balance of interests. Maybe a different decision.
Under legitimate interests:
we can send differentiated hard copy letters
we must review our mailing list - the Legitimate Interest Assessment
we must not email those letters unless we comply with the ‘soft opt-in’. Say, what?! Read on.
The charitable purposes soft opt-in
With UK GDPR sit the Privacy and Electronic Communications Regulations (PECR). These regulations govern electronic and phone marketing. Now, we don’t think of it like this but churches ‘market’ lots. Like invites to Carols by Candlelight. A Facebook piece is fine. It’s not marketing directly to an individual. But a personal email is direct marketing.
Key point: marketing includes our stewardship programme.
If our lawful basis is legitimate interests, the PECR requirement is that we can only email our giving ask letters (or any church marketing materials) if we meet the three criteria of the charitable purposes soft opt in. ICO guidance arrived April 2026. Read accessible overviews here and here and here.
personal data must be supplied on or after 5th February 2026. It’s not retrospective.
personal data was collected when someone was, ‘expressing an interest in, or offering or providing support for’ the life of the church. That’s from the ICO guidance. For you and me it means worship, giving, volunteering, prayer group. But not, say, a church register search for ancestry purposes.
at data collection, paper or online, the individual must be able to opt out of further emails - and in all subsequent emails or electronic comms. It’s the familiar ‘unsubscribe’ link.
A curate’s egg - good and not so good
Remember: this is about electronic marketing. It’s not emails about the flower rota. The soft opt-in is like the curate’s egg. The good bit: it adds flexibility when legitimate interests is our lawful basis. New folk in church can sign up and opt out if they wish in usual ways: pew and clergy contact cards, Alpha sign ups, food bank volunteering. That number will keep on growing.
The not so good: it doesn’t include existing church members prior to 5th February 2026. We may want to think about a ‘contact refresh’ that satisfies the three criteria, and our admin must be up to scratch. There’s guidance in Building the Database.
we can email our ask letters under legitimate interests if we satisfy three soft opt-in criteria
we must have good administration in all our GDPR compliance
Conclusions
One more time. The soft opt-in is part of our GDPR compliance under legitimate interest. It’s about much more than stewardship. But we’re planning a stewardship programme.
Any ask is better than no ask at all.
If we’re under pressure, we’ve got the option to use generic, undifferentiated letters: handed out in church and at meetings, generic letters on the website, highlighted in social media posts with electronic response forms which are from individuals. Remember: these forms must include the opt-out clause.
The downside is losing something valuable: the benefits of differentiation and a little of the personal touch. It’s a local, thoughtful, prayerful decision.
The gift of administration
Administration sits with the spiritual gifts in 1 Cor 12:28. The Greek word is kubernesis: one who steers, guides, enables.