Sharing Members' Contact Details: What Churches Should Consider

Sharing Information Comes with Responsibility

Churches may need to share members’ contact details with ministry leaders, fellowship groups, event organisers, or other church departments. While this can support church activities, it is important to consider whether the information is necessary, who needs access to it, and why it is being shared.

For example, a fellowship leader may need members’ telephone numbers to coordinate a meeting. However, sharing the entire church membership database with every group leader may expose more information than necessary.

The principle is simple: Share information responsibly, with a clear purpose and appropriate safeguards.

What Should Churches Consider Before Sharing?

Before sharing members’ personal information, churches should consider the following:

1. Is There a Clear Purpose?
Understand why the information is needed and whether sharing it is necessary for the intended church activity.

2. Is There a Lawful Basis?
Ensure that the sharing complies with Kenya’s Data Protection Act, 2019, and that an appropriate lawful basis exists for processing the information.

3. Who Really Needs Access?
Limit access to authorised individuals who need the information to carry out their church responsibilities.

4. Have Members Been Informed?
Members should understand how their personal information will be collected, used, and shared. Where consent is the appropriate lawful basis, obtain it in accordance with applicable requirements.

5. Is All the Information Necessary?
Share only the details required for the intended purpose. A ministry leader coordinating a meeting may need names and telephone numbers, but not members’ family details or other unrelated information.

6. Could Sharing Expose Members to Risk?
Consider whether sharing the information could lead to unwanted calls, unsolicited messages, scams, embarrassment, or misuse of personal details.

7. Is the Information Being Shared Securely?
Avoid distributing membership lists through unsecured channels or sending them to unintended recipients. Use appropriate security measures when sharing files and records.

8. Are Third Parties Involved?
If information is shared with external service providers, event organisers, or other organisations, establish whether the sharing is lawful and ensure appropriate safeguards are in place.

9. Does the Information Include Sensitive Personal Details?
Information about health, religious beliefs, or other sensitive matters requires particular care. Churches should apply the additional protections required by law.

10. Has the Member Agreed Where Necessary?
Do not assume that providing information to the church means a member has agreed to every possible use or disclosure. Determine whether consent or another lawful basis is required.

11. Is the Information Still Accurate and Necessary?
Avoid sharing outdated contact lists or retaining personal information longer than necessary for the purpose for which it is held, subject to applicable legal obligations.

12. What Happens if Information Is Shared Incorrectly?
Churches should have procedures for reporting and responding to accidental disclosures, unauthorised access, and other personal data breaches.

Practical Ways Churches Can Protect Members’ Privacy

Churches can take the following practical steps to strengthen data protection and build a culture of responsibility:

1. Develop a Data Protection Policy
Establish clear guidelines explaining how members’ information is collected, stored, accessed, used, shared, and protected.

2. Inform Members About Data Use
Explain why personal information is collected, how it will be used, who may access it, and what rights members have under data protection law.

3. Restrict Access to Membership Records
Ensure that pastors, administrators, ministry leaders, and volunteers access only the information necessary for their respective roles.

4. Obtain Consent Where Appropriate
Seek consent where it is the applicable lawful basis, such as for certain optional communications, photographs, or other uses. Make sure the consent process meets legal requirements.

5. Avoid Sharing Entire Contact Lists Unnecessarily
Provide ministry leaders with only the contact details they need rather than distributing the complete church membership database.

6. Use Secure Communication Channels
Take care when sending membership lists through email, messaging applications, or other digital platforms. Verify recipients before sharing files.

7. Train Staff and Ministry Leaders
Educate pastors, church administrators, volunteers, and fellowship leaders on confidentiality, responsible information sharing, and data protection obligations.

8. Secure Digital Records
Use systems with appropriate access controls, strong authentication, secure backups, and other suitable safeguards to protect members’ information.

9. Protect Physical Documents
Keep printed membership forms, registers, counselling records, and other confidential documents in secure locations with controlled access.

10. Establish Rules for WhatsApp and Other Groups
Avoid adding members to communication groups or publishing their contact details without considering the appropriate lawful basis, transparency, and privacy implications.

11. Handle Photographs and Videos Responsibly
Inform members about how photographs and recordings will be used, particularly when publishing them online. Obtain consent where required and exercise extra care when children are involved.

12. Manage Third-Party Access
Review how external service providers, bulk SMS providers, software vendors, and other partners handle members’ information. Put appropriate data protection agreements and safeguards in place where necessary.

13. Keep Membership Records Up to Date
Review contact lists periodically and correct inaccurate information. Dispose of information securely when it is no longer required and no legal obligation requires its retention.

14. Establish a Data Breach Response Procedure
Have a clear process for reporting, assessing, and responding to incidents involving lost, exposed, or improperly shared personal information. Meet any applicable notification requirements.

15. Respect Members’ Data Protection Rights
Put procedures in place to receive and respond to requests concerning access to, correction of, or other rights relating to personal information, as provided under applicable law.

16. Review Data Protection Practices Regularly
Periodically assess how information is collected, accessed, stored, and shared. Update policies and procedures when church activities, technology, or legal requirements change.

17. Appoint Responsibility for Data Protection
Assign appropriate responsibility for overseeing data protection, answering members’ questions, monitoring compliance, and guiding staff and volunteers.

18. Promote a Culture of Confidentiality
Remind everyone handling church records that access to personal information comes with a responsibility to protect it. Confidentiality should be part of the church's culture, not just a written policy.

Protecting Privacy Is Part of Caring for the Church

The Church is called to be a place of trust, care, and accountability. Protecting members’ personal information reflects these values and demonstrates respect for the people entrusted to its care.

As Proverbs 11:13 reminds us, a trustworthy person keeps a confidence.

In an increasingly digital world, churches must ensure that the responsibility of caring for their members extends to how their personal information is handled.

Before sharing, pause and ask: Is it necessary? Is it appropriate? Is it secure?

These simple questions can help churches build a culture of privacy, responsibility, and trust.

How GlideMission Supports Responsible Church Management

GlideMission helps churches organise membership information and manage church operations through a centralised system. With appropriate access controls and responsible data management practices, churches can better manage who accesses information and how it is used.

Technology alone does not guarantee compliance. Churches must also establish appropriate policies, procedures, and practices to protect members’ personal information.

GlideMission — Serving the Church Through Technology.