Religious records and UK data protection law: can baptismal data be deleted?

A recent EU court referral asks whether a church may keep a person’s baptismal record after they object. The case concerns the Catholic Diocese of Ghent. A man baptised as a child asked for his details to be deleted; the diocese instead noted that he had left the Church. Belgium’s regulator ordered erasure and the dispute was referred to the Court of Justice of the European Union (CJEU) as Case C-12/25, Bisdom Gent.

Advocate General Laila Medina said a structured paper baptismal register can fall within the EU GDPR. An objection may lead to erasure unless the church proves compelling legitimate grounds for continued processing or another exception that would allow continued lawful processing. The opinion is non-binding and the CJEU has not yet given judgment, but it is a useful warning that religious or historical importance does not automatically override privacy rights.

Is religious data covered by UK data protection legislation?

Yes. Information revealing religious or philosophical beliefs is special category data under the UK GDPR and receives extra protection. Baptismal entries, membership lists, attendance records, pastoral notes and some donation records may fall within this category.

The rules can cover electronic records and structured paper filing systems where information about individuals is readily accessible. UK organisations must comply with the UK GDPR and Data Protection Act 2018 and should monitor current ICO guidance.

What does this mean for religious organisations processing personal data?

Religious bodies have no general exemption. For special category data, they normally need both a lawful basis under Article 6 and a separate Article 9 condition. They must also process data fairly and transparently, keep it secure, minimise it and retain it only as long as necessary.

In practice, organisations should map their sacramental, membership, pastoral and archive records; document the purpose, legal basis and retention period; restrict access; and have a process for objections, rectification and erasure requests. Any refusal should record the evidence and balancing exercise relied upon.

The Ghent opinion stresses necessity: a sincere religious or historical purpose is not enough on its own. The organisation should show why identifiable data remains needed and why a less intrusive option would not work.

What exemptions or special conditions could a religious organisation rely upon?

Article 9(2)(d) may cover a not-for-profit body’s legitimate religious activities involving members, former members or people in regular contact with it, subject to safeguards. Data must not be disclosed outside the body without consent. This is a processing condition, not a blanket exemption.

Other grounds. Depending on the facts, explicit consent, legal claims, a legal obligation or qualifying archiving in the public interest or historical research may apply. Calling a register ‘historic’ is not enough: the organisation should identify the public interest, necessity, access controls, data minimisation and safeguards. Some Data Protection Act 2018 conditions require an appropriate policy document.

Any condition or exemption must be justified case by case. A policy stating that all religious records are permanent and can never be corrected or erased is risky.

Can an individual insist on deletion or rectification of religious records?

An individual can ask, but neither right is absolute. Under Article 16, inaccurate data should be corrected and incomplete data may be completed. If a record accurately states that a historical event occurred, disagreement with its religious meaning does not necessarily make it inaccurate; a supplementary statement may sometimes be suitable.

Article 17 permits erasure in circumstances including where data is no longer needed, processing is unlawful, consent is withdrawn with no other basis or an objection succeeds. A request may be refused where a specific exception applies, for example a legal obligation, qualifying public-interest archiving or historical research, freedom of expression and information or legal claims.

If identity retention is unjustified, crossing out a name while leaving it readable may not be enough. The Advocate General of Belgium suggested making identifying details illegible while retaining non-identifying details such as the time and place of baptism. Although not binding in the UK, this illustrates a possible data-minimising approach. A refusal should give reasons and explain the right to complain to the ICO.

Why is the EU case relevant after Brexit?

The eventual CJEU judgment will not automatically bind courts in England and Wales, as the UK has now left the EU. However, it remains relevant because the UK GDPR uses wording similar to the EU GDPR. As such, UK courts and the ICO may find the reasoning persuasive.

It also addresses familiar UK issues: necessity, proportionality, data minimisation, retention and balancing privacy against religious freedom. Religious organisations should therefore be ready to prove why identifiable information is still needed and why their response is proportionate.

Get in touch

Religious records involve sensitive beliefs, established practices and competing rights. Our specialist data protection solicitors advise organisations on lawful bases, retention and rights requests and individuals concerned about unlawful use of their data.

For advice tailored to your circumstances, please contact Nelsons’ data protection team.