Church Data Security: Access, Backups and Breach Plans

A church database knows where the widow lives alone, which child carries an epinephrine pen, which household gave $40,000 last year and which marriage nearly ended in March. Every example below uses Riverside Community Church in Cedar Falls, Iowa, a sample church with four staff members, a children’s ministry and about forty volunteers who touch the database.

Primary sources and professional review

Source check: October 23, 2026. FTC COPPA guidance. The FTC links the revised rule at the top of this guidance. Coverage depends on the operator and activity. Ask counsel to check the church and its vendors against the current rule.

What member data does a church hold?

Four kinds, and each kind gets its own readers. Directory details are the least sensitive, and pastoral records are the most sensitive and never go in the software.

Tier	What it holds	Who sees it
1. Directory	Name, household, address, phone, email, birthday, membership date	Staff, and members who agreed to be listed
2. Operations	Attendance, serving, groups, children’s check-in, allergies, background check status	Staff and the leaders whose work needs it
3. Giving	Giving by name, pledges, benevolence received	The financial secretary and one named officer
4. Pastoral	Counseling notes, discipline, confessions, abuse reports, health crises	A locked drawer, never the software

The tier decides the readers. A person who needs tier two for one ministry sees that ministry’s records, and nothing more.

Tier one needs consent. A woman who left an abusive marriage has a reason to be unlisted, and she should not have to explain it to the church secretary. The free church directory maker prints only what each family chose to show.

Free tool you can try here

Make a directory page

Type one family and see its entry. The real tool opens with that family at the top of your list.

This free tool is made by Church Posting.

Church name

Family name

Adults

Children

Phone

Riverside Community Church

Church directory

Brooks

Michael and Hannah

Ella, Sam

(417) 555-0191

Carter

James and Linda

(417) 555-0112

Use it free

The maker is free and keeps your list and photos in your browser.

Who should see each kind of record?

Give each role the tiers its work needs and no more. Write the list down, print it each quarter and read it aloud at a staff meeting.

Role	Directory	Operations	Giving	Pastoral
Senior pastor	Yes	Yes	Totals only	Own notes, on paper
Church administrator	Yes	Yes	No	No
Financial secretary	Yes	No	Yes	No
Children’s director	Yes	Children’s ministry	No	No
Small group leader	Own group	Own group’s attendance	No	No
Check-in volunteer	No	Sunday’s check-in screen	No	No

A sample list. Riverside’s elders chose to keep the preaching pastor to giving totals, so no sermon can be suspected of following the money. Make that call as a board and write it down.

Should counseling notes go in church management software?

No. A private note in church software is one administrator’s mistake away from a report or an export, and every record leaves in a spreadsheet the day the church changes systems.

Keep pastoral notes brief, on paper, in a locked drawer in the office of the person who wrote them, with a written retention period. Notes in a shared system are also harder to defend as confidential if a court asks what the church knew.

Clergy are mandatory reporters of child abuse in many states, and each state writes its clergy-penitent privilege differently. The Child Welfare Information Gateway keeps a state-by-state summary, current through May 2023. Read your own state’s entry, ask an attorney in your state how the privilege and the reporting duty fit together, and write your policy. An abuse report follows your state’s law at once, on its own track.

How do I protect a church database?

Give every person their own login with two-factor sign-in, keep the passwords in a church-owned manager, and remove access the day someone leaves.

1. Every church system

Sign-in

• One login per person Shared logins make every change untraceable On
• Two-factor sign-in An app or a security key, for every staff login On
• Passwords kept in Church billing and two administrators Church password manager

Ownership

• Account email Never a staff member’s personal address A church address

Devices

• Lock screen on laptops and check-in tablets On

CISA says people who turn on multi-factor sign-in are significantly less likely to be hacked. Set it on the four systems above first, because each one can reset the others.

The other controls, in the order a church office usually skips them:

1. Offboarding checklist. The day someone leaves staff or rotates off a team, a named person removes their access from every system, check-in volunteers included.
2. Quarterly permission review. Print the user list, read it aloud at a staff meeting and remove people. It takes about ten minutes.
3. Every account in the church’s name. The website, the domain, the streaming channel, the social accounts and the Google or Microsoft account. An account in a personal address is one resignation from being lost.
4. Giving visibility set by policy in the software, so the question never comes up person by person.
5. No card numbers stored, including paper authorization forms in a drawer.
6. Background check reports locked away with a retention period.
7. A purge schedule for children’s check-in data. Last year’s pickup codes have no use.
8. A quarterly full export to encrypted church-owned storage. Once a year, open the file and confirm the data is in it.

Do church volunteers need background checks, and where do the reports go?

Anyone who works with children should be checked, and the report goes in a locked place outside the software. The software holds only the status, such as cleared on a date.

Jordan Ellis, nursery volunteer

Background check: cleared March 3, 2026

Report: locked file, church office

Under the National Child Protection Act, states may set up procedures for organizations to request a nationwide background check on people who care for children, and the Attorney General runs a program in states that have none (34 U.S.C. 40102). Use the route your state operates and ask what it returns. A criminal history summary on a volunteer is the most damaging file in the building if it leaks.

Does PCI compliance apply to a church?

Only if the church stores, processes or transmits card numbers itself. Let the giving platform hold the cards and the church stays out of most of it.

The PCI Security Standards Council applies its standard to entities that “store, process, or transmit cardholder data.” A card number written on a paper pledge form puts the church in that group. Compare platforms in what giving platforms cost, and choose one that keeps the card numbers on its own systems.

Does a church need a privacy policy?

Yes, and one paragraph covers it. Members should know what the church collects, why, and how to be left out or removed.

Line	Riverside’s wording
What we collect	Your name, household, contact details, attendance and giving.
Why	To care for you, plan ministry and send your giving statement.
Who can see it	Staff and the leaders whose ministry needs it. Giving is seen by the financial secretary and the treasurer.
The directory	Printed twice a year. You are listed only if you agree.
How to change it	Ask the office to correct, hide or remove your record, including after you leave.
What we never do	Sell, trade or share the roll with anyone outside the church.

Put it on the website and in the membership packet, then keep it. A visitor who fills out a prayer card has not joined the all-church email list.

The guest side of this is in a guest follow-up system one volunteer can run.

Photographs of children need a parent’s written permission before they go online. The federal children’s privacy rule (16 CFR 312.2) excludes nonprofit entities that are exempt from the FTC Act, so for most churches the permission rule is a promise to parents. Keep the list of families who said no where the person posting to social media can see it, and read the church social media policy for the rest.

What should a church do after a data breach?

Follow a one-page plan the board approved in advance. Call one named person, contain the damage, preserve the evidence, then notify.

1. 1 Call one person AdministratorBackup: chair of elders They decide and keep the written record.
2. 2 Contain Reset passwordsSign out sessions Take the system offline if it is still leaking.
3. 3 Preserve Delete nothing Screenshot, note the time, keep the logs. This is the step people skip.
4. 4 Find the scope Which tierHow many people Over what dates, and which records.
5. 5 Notify and tell State lawAttorney Notify as your state requires, then tell the congregation plainly.

NCSL reports that all 50 states have breach laws requiring disclosure when personal information is compromised. They differ on what data triggers a duty and how fast, so name your attorney now.

Which church software keeps member data safest?

The one that lets you set access by role, turn on two-factor sign-in and export everything. A system you cannot export from is a system you cannot check.

Run the export test in church management software prices before you buy, and check where each free plan stops in free church management software, because permission controls are often the first thing a free plan leaves out.