# Church data breach plan

One page. Fill in the blanks, have the elders or the board approve it, print it, and keep a copy where the office can find it without a computer.

Church: ______________________________
Approved by the board on: ______________
Review again on: ______________

## 1. Call first

Name: ______________________________ Phone: ______________
Backup: ______________________________ Phone: ______________

This person decides what happens next and keeps the written record.

## 2. Contain

- Reset the password on every affected account.
- Sign out every session on those accounts.
- Take the affected system offline if it is still leaking.
- Remove access for anyone who should not have it.

## 3. Preserve

- Delete nothing.
- Screenshot what you saw, with the time.
- Keep the system's logs and the emails that alerted you.
- Write down who did what, and when, from the first minute.

## 4. Find the scope

- Which kind of data: directory, operations, giving, or pastoral?
- How many people?
- Over what dates?

## 5. Notify

Our state's breach notification law: ______________________________
Our attorney: ______________________________ Phone: ______________
Our insurer: ______________________________ Phone: ______________

Read the state law before anything happens. The laws differ on what data triggers a duty to notify and how fast the church must act.

## 6. Tell the congregation

In plain words: what happened, what was exposed, what the church is doing, and what each person should do now.

---

From Church Posting, churchposting.com/resources/software/protecting-member-data/. This page is a planning form, not legal advice.