Safeguarding Digital Communication with Church Members

Most churches now message their members every week, and few have written down how.

A church that stays in touch with members between Sundays, through WhatsApp groups, small-group chats, texts and social media, needs a short written digital communication policy. It should name the channels approved for pastoral contact, say who may message a young person or vulnerable adult and how, set what happens to a message thread when a volunteer leaves, and require consent before a photo, testimony or personal detail goes online. Thirtyone:eight and the Church of England's safeguarding guidance both expect a policy like this to exist and be followed year-round. UK GDPR governs any member data the church stores, including a phone number, a photo or a group chat log. A short, written shape keeps midweek encouragement fast and safe.

How should a church communicate safely with members during the week?

A church communicates safely between Sundays by keeping pastoral contact on named, approved channels the leadership has agreed on together. "Therefore encourage and build one another up, just as you are already doing" (1 Thessalonians 5:11). That instruction assumes contact happens across the whole week.

Three practical steps make it safe:

1. Name the channels. Pick a small, fixed set (a group messaging app, a group email, SMS from a shared number) and put them in writing. A member should always know where church contact will come from.
2. Separate personal and pastoral. A leader's personal WhatsApp or Instagram DMs should not be the only record of pastoral contact with a child, a young person or a vulnerable adult. Use a shared or church-owned channel wherever the contact touches safeguarding.
3. Build in a second pair of eyes. For small-group leaders and youth workers, a second leader or the safeguarding lead should have visibility of group chats involving under-18s, in line with the accessibility principle thirtyone:eight sets out for youth and children's work.

Digital discipleship, a small group chat that prays through the week or a leader checking in after a hard Sunday, works well inside this shape. The risk sits in contact nobody else can see and nobody wrote down.

What should a church's digital communication and social media policy cover?

A church's digital communication policy should cover five areas in one document every leader has read: approved channels, who may contact whom and how, content standards for public posts, data handling, and what happens when a leader or volunteer leaves.

1. Approved channels and their purpose. State which apps are for what: a group chat for prayer requests, a page for public updates, a private list for pastoral care.
2. Who can contact whom. Clear rules for adult-to-child contact, and for one-to-one contact between any leader and a vulnerable adult.
3. Content standards. What the church will and will not post publicly: no identifying detail about a safeguarding concern, no photo of a child without consent on file, no testimony shared without agreement.
4. Data handling. Where member data lives, who can access it, and how long it is kept. This is the UK GDPR piece; the Information Commissioner's Office publishes guidance for charities and faith groups.
5. Leaver process. What happens to a WhatsApp group, a shared inbox or a contact list when a volunteer stands down.

A policy this short can sit on two pages. The section below gives clauses to paste straight in.

How do you keep midweek pastoral contact and small group messaging safe?

Midweek pastoral contact and small-group messaging stay safe when the group has a named leader, a second leader with visibility, and a habit of moving anything sensitive off the group thread.

Small-group chats are where most churches actually communicate discipleship: a prayer request on a Tuesday, an encouragement after a hard week, a reminder before Sunday. Three habits protect it:

1. Two named leaders on every sensitive chat. A group chat that includes under-18s or vulnerable adults has a second named leader who can see it, matching the two-adult principle safeguarding bodies apply to in-person youth work.
2. Move the hard conversation off the group. A group thread is for the whole group. A pastoral concern about one member goes to a private, appropriate channel and gets recorded there.
3. Archive a closed group's history. A closed small group's chat may hold pastoral information the church needs later. Export it to a safe, access-controlled place before the app account that hosted it disappears.

Encouragement between Sundays is the whole point of these groups. "Encourage the fainthearted, help the weak, and be patient with everyone" (1 Thessalonians 5:14) describes the work; a small amount of structure is what lets it keep happening safely, year after year, through leader changes.

What are the safeguarding rules for one-to-one and private messages?

One-to-one and private messages between a church leader and a young person or vulnerable adult need three things every safeguarding body agrees on: a second adult in the loop, a written record, and no secrecy.

1. Never message a minor one-to-one on a personal account. Contact with under-18s runs through a parent-copied channel, a group thread, or a monitored church account. This mirrors thirtyone:eight's guidance for safe online contact with children and young people.
2. Copy in a second adult for vulnerable adult pastoral care. Where a leader supports a vulnerable adult one-to-one, another leader or the safeguarding lead should know the contact is happening and have some visibility of it.
3. Keep it recordable. A one-to-one pastoral conversation can stay private and still survive scrutiny: the test is whether a leader would be comfortable showing the message to the safeguarding lead.
4. Argue your case without betraying a confidence. "Argue your case with your neighbor without betraying another's confidence" (Proverbs 25:9) is a good working rule for how a private pastoral matter gets discussed even among leaders: on a need-to-know basis, never as gossip dressed as prayer requests.

Where a church is unsure whether a specific pattern of one-to-one contact is safe, check with its safeguarding lead or with thirtyone:eight directly.

How should leaders handle photos, testimonies and member data shared online?

Leaders should get specific, recorded consent before a photo, testimony or personal detail about a member goes online, and treat that consent as revocable at any time.

1. Ask before you post, every time. A photo of a child at a youth event, a testimony shared in a small group, a prayer request read aloud: none of these were given for republication on social media by default. Ask, and keep a simple record of who said yes to what.
2. Consent for a child comes from a parent or guardian, in writing, renewed on a set schedule the church chooses.
3. Let people say no later. UK GDPR gives an individual the right to withdraw consent and have personal data, including a photo, removed. A church's process should make that request as simple as a message to the office.
4. Store data with a reason and a limit. Keep contact details and pastoral notes only as long as they serve their purpose, and know where they are held. The ICO's guidance for charities sets out what a reasonable retention policy looks like; a church unsure of its own position should check it directly.

Testimonies of what God has done deserve to be told well. Consent is what turns the telling into a gift the person actually gave.

How do you write a digital communication code of conduct for your church?

Write a short code of conduct, one page, covering channels, contact rules, content standards and data, and have every leader and volunteer read and sign it before they message a member on the church's behalf.

Below is a clause set a leadership team can paste into a handbook and adapt.

Digital communication code of conduct

1. Approved channels. Pastoral and group contact with members happens only through the channels this church has named: [list channels]. Personal social media accounts and private numbers are not used as the sole record of pastoral contact.

2. Contact with under-18s. No leader messages a young person one-to-one on a personal account. Contact runs through a group thread, a parent-copied channel, or a monitored church account.

3. Vulnerable adults. One-to-one pastoral contact with a vulnerable adult is known to at least one other leader or the safeguarding lead.

4. Content standards. Nothing identifying a safeguarding concern is posted publicly. No photo or testimony is shared online without recorded consent from the person, or from a parent or guardian for a child.

5. Data handling. Member data is stored only where the leadership team has agreed it should be, kept only as long as it serves a clear purpose, and a member may ask at any time what is held about them and request its removal.

6. Leaving a role. When a volunteer or leader stands down, access to group chats, shared inboxes and contact lists transfers back to the church within [a set number] of days.

7. Review. This code is reviewed by the leadership team at least once a year.

Adapt every clause to the church's own structure and denomination guidance, and check any clause touching child protection against thirtyone:eight or the church's safeguarding body before adoption. A code every leader has actually read turns caution into something a new volunteer can simply follow.

FAQ

How can a church encourage members between Sundays?

Through named, approved digital channels: a small-group chat, a shared church account, or a scheduled midweek message, all covered by a written communication policy so encouragement does not depend on one leader's personal phone.

Does a church need a social media policy?

Yes. Any church with a public page or a leader posting on its behalf needs written content standards covering what can be posted about members, how photos and testimonies get consent, and who moderates comments and messages that arrive through it.

What does UK GDPR mean for a church's WhatsApp groups and member lists?

Member data, including a phone number, a photo or a chat log, is personal data the church is responsible for. The church should know why it holds each piece of data, how long it keeps it, and be able to act on a member's request to see or remove it. The Information Commissioner's Office publishes guidance written for charities and small organisations.

Who should see a private pastoral message a leader sends to a member?

At minimum, the leader who sent it and the member who received it, with a second leader or the safeguarding lead aware the contact happened when it involves a child or vulnerable adult. A private message should never be the only record of a safeguarding-relevant conversation.

Where can a church get authoritative safeguarding guidance for digital communication?

Thirtyone:eight and the Church of England's safeguarding team publish current guidance for churches, and the Charity Commission covers trustee responsibility for safeguarding more broadly. A church unsure how a rule applies to its own structure should check with its safeguarding body rather than assume.

---

Keep Reading

• How Churches Can Encourage Members During the Week
• Recording Prophetic Words: Consent and GDPR for Churches
• Safeguarding in Prophetic Ministry
• Building a Culture of Remembering in Your Church

Doxa gives churches one place to record pastoral encouragement and testimonies through the week, with consent built into the process. It is free to start. See how it works for churches.