Ask a pastor in a small church where the member list is, and the answer is often "the spreadsheet". Ask again, and it can turn out there are five lists. One is on the church laptop, one is in a WhatsApp group, one is in the giving platform, and one is on a volunteer's phone. Another is in an email account nobody has opened since the person who set it up moved away.
That is normal. Nobody planned it. A church grows one helpful volunteer at a time, and each of them keeps numbers where it suits them.
This check takes about 30 minutes. You need a pen, a sheet of paper and your own phone, and you can do it with one or two of the people who help you on Sundays. You do not need any software. It is information, not legal advice.
Why it matters
The Protection of Personal Information Act (POPIA) counts religious belief as special personal information. Processing it is prohibited unless an exception in section 27 applies, and consent is one of several grounds. Section 28 gives churches some room with their own members, but it does not let you pass that information to third parties without consent. See this summary of the rules and the Information Regulator's guidance note.
A list of the people who belong to your church is, in effect, a list of people's religion. That is why it deserves a little more care than a shop's customer list. It also matters more now that tools like Claude can read a spreadsheet you give them. Before you decide what to share with any tool, you need to know what you have and where it is.
You cannot look after a list you do not know about. So the first job is to find out how many there are.
The check
Draw a table with four columns: where it is, who can see it, what is in it, and who looks after it. Then go through these places one at a time.
- Spreadsheets. Search the church computer and any shared drive for "members", "contacts", "directory" and "cell group". Look at old copies too. Note who has a copy on a flash drive or in their own email.
- WhatsApp groups. List every group the church runs. For each one, write down who the admins are and how many people are in it. Members of a group may be able to see each other's numbers. Ask whether everyone in the group knew that.
- The giving platform. Whatever people use to give online or by card holds names, numbers and amounts. Log in, find out who has access, and note whether anybody who has stepped back from the church still has it.
- Volunteers' phones. The youth leader, the children's team and the sound team all keep numbers on their own phones. Write down who has what. You are not telling anyone off. You are finding out.
- Old email accounts. Think of the previous person who ran the admin and the old church address. Is there a mailbox that still holds attendance lists, forms or photos? Who has the password?
- Paper. Visitor cards, registration forms and the sign-in sheet for Sunday school. Where do they go after Sunday?
Mark each one
When the table is full, mark every row with one of these.
Keep. It is in use and one named person looks after it.
Merge. It copies another list. Pick the main list and plan to retire the copy.
Delete. Nobody uses it and there is no reason to keep it.
Find out. You do not know who has access.
Do the "find out" rows first. Those are where a former volunteer's access is most likely still open.
Questions to ask any app or vendor
If you use, or are thinking of using, church management software, a giving platform or an app, ask these. Put the answers in writing. A clear, plain answer is a good sign; a vague one is worth a follow-up question.
Where is our data stored? Name the country. If it is outside South Africa, ask which one.
Is it copied or backed up in another country? Ask about the backups as well as the main copy.
Who at your company can see our members' details? And do your support people use outside tools to read them?
Do you use our data to train AI? Ask for the answer in writing, and ask where the setting is.
Can we export everything, in a format we can open, if we leave? And how long do you keep it afterwards?
What happens if there is a breach? How will you tell us, and how quickly?
Is there a written agreement that covers the personal information you handle for us?
The cross-border point
POPIA section 72 limits sending personal information to a third party in another country unless a ground applies, such as consent, a binding law or agreement that gives adequate protection, or necessity for a contract. Please read the wording yourself in the Act. Two plain explainers are from Michalsons and MJK.
Law firm CMS notes that the Regulator has not said what counts as adequate protection (CMS). That is why a plain answer in writing matters. If your church uses a tool with servers abroad, that is not automatically a problem. It is something to ask about and write down, and to take to a lawyer if you are unsure.
If you want to compare products, Capterra's South African list of church management software is a place to start. Whichever list you start from, ask each vendor where the data is stored.
What to do next week
You do not need a policy committee. Four small steps are enough.
- Choose one person to own the main list. It can be you.
- Set a simple rule that new numbers go onto that list first.
- Remove old people from the giving platform and from the WhatsApp groups where they no longer belong.
- Put the table somewhere safe, and look at it again in six months.
Once that is done, you will know what you could safely share with an AI tool and what you should keep out of it. I wrote about that in Is it safe to put church members' details into Claude?
If you would like company
If you would like someone to look at it with you, I am glad to talk. The Where to start conversation is free and has no strings. We look at what you have and what is worth doing first. If you want to ask something before that, send me a message.