Recording Prophetic Words and Testimonies: Consent and UK GDPR

A word about someone's health gets scribbled on the back of an order of service, and by the next elders' meeting nobody can say for certain who agreed to keep it, let alone who agreed to share it.

A recorded prophetic word or testimony is personal data under UK GDPR from the moment it is written down or recorded, and because it almost always touches someone's religious belief, and often their health, marriage or family circumstances too, it is usually special category data under UK GDPR's Article 9. Processing it lawfully needs explicit consent: freely given, specific to this recording, informed about what happens to it next, and confirmed by a clear, active statement. Someone simply staying in the room does not give it. Publishing a testimony beyond the pastoral record, on a website, in a newsletter, or from the stage, needs a second, separate consent. This guide sets out what UK GDPR expects of a church that records prophetic words and testimonies, with sample consent wording and a retention schedule a leadership team can adapt.

Why record prophetic words and testimonies at all?

Recording protects the person who received the word, the person who gave it, and the church's ability to weigh it honestly later, because memory alone does not hold up. A word shared with someone in a service rarely survives the drive home unchanged: two people who heard the same sentence describe it differently by Tuesday, and a testimony retold from the front usually gathers a detail nobody actually said. "Two or three prophets should speak, and the others should weigh carefully what is said" (1 Corinthians 14:29); a team cannot weigh a memory that has already changed shape. "But Mary treasured up all these things and pondered them in her heart" (Luke 2:19); a written record does the same work on paper. Recording well also means giving the person a copy of what was written or recorded, and telling them plainly what happens to it next: who keeps it, who can see it, and how long it stays.

Is a recorded prophetic word personal data under UK GDPR?

Yes. If a recorded word or testimony names a person, or is about someone identifiable from the details even without a name, it becomes personal data the moment it is written down or recorded. A prophetic word is, by definition, something someone believes God said about a person's life, and a testimony usually describes what happened to that person, so both routinely touch what UK GDPR calls special category data: religious belief on almost every occasion, plus health, and often marriage, family or financial circumstances layered on top. Special category data is a defined list: race or ethnic origin, political opinion, religious or philosophical belief, trade union membership, genetic data, biometric data used to identify someone, health data, and sex life or sexual orientation. Religious belief and health both sit on that list, and a church recording what God said to someone about an illness, a pregnancy, or a marriage is very often handling both at once. Special category data needs more than the ordinary basis a church might rely on for a membership list; it needs a separate condition under UK GDPR's Article 9, and for a church recording a person's own words, that condition is almost always explicit consent. This is guidance for building a church policy; confirm the specifics against current ICO guidance or your denomination's data-protection officer before treating it as finished legal advice.

What consent does a church need to record a word or a testimony?

Explicit consent, given before the recording starts, is the practical answer for most churches. Under UK GDPR, explicit consent has to be freely given, specific to this recording and this purpose, informed about what happens next, and confirmed by a clear, active statement, spoken or written. Someone staying in the room does not count, and neither does a phone appearing mid-service. In practice:

1. Ask before the recording starts, and name what is being recorded: a prophetic word, a testimony, or both.
2. Say what happens to it: who holds the record, who on the team can see it, and what it will be used for, usually pastoral weighing and an internal archive, nothing wider unless separate consent follows later.
3. Get a clear yes, out loud or in writing. Silence or a nod that could mean several things is not enough.
4. Keep consent to record separate from consent to share. A person can be glad to have a testimony written down and still not want it read from the stage.
5. Give the person a copy of what was recorded, so nothing exists about them that they have not seen.

Consent gathered this way is easy to defend later, because it answers the exact question the ICO expects a church to be able to answer: what did this person actually agree to.

How long should a church keep the record, and who may see it?

As long as the stated purpose needs it, and no longer, seen by as few people as that purpose requires. Two UK GDPR principles do the real work: data minimisation, which means collecting and keeping only what a stated purpose needs, and storage limitation, which means setting a retention period and actually deleting or archiving records once it passes. Left alone, records accumulate in a shared folder nobody owns; a dated schedule is what keeps that from happening. Practically, decide before anything is recorded who is on the team that can see a word or a testimony, such as the pastoral or prophetic ministry team specifically, kept smaller than the whole staff group chat, where it is stored, ideally a system with proper access controls and not a personal phone's voice memos, and when it gets reviewed. Security matters as much as the schedule: encrypt what is stored, limit access by role, and never let a sensitive entry live only in a personal WhatsApp thread. A short retention schedule, reviewed annually, turns 'kept as needed' into something the team can actually check. There is a sample one below, alongside the consent wording.

What consent is needed to share a testimony publicly?

A separate, specific consent, asked for fresh at the point of sharing. Recording a testimony for the pastoral record and publishing it on a website, in a newsletter, from the stage, or on social media are different acts under UK GDPR, and each deserves its own agreement, particularly where the testimony touches health or another sensitive detail. Before anything goes public, ask again, name exactly where it will appear, and let the person agree to that specific use. Consent can be withdrawn at any time, and UK GDPR expects withdrawal to be roughly as easy as giving it was, so a church needs a simple way for someone to ask for a testimony to be taken down, and a plan for what taken down means in practice: removed from the website and any archive by the time the next Sunday's slides go up. A testimony involving a child or a vulnerable adult deserves an extra pause and, where appropriate, a parent, guardian or safeguarding lead in the conversation before anything is shared beyond the pastoral team.

What should the consent wording say?

State plainly what is being recorded, why, who will see it, and how a person opts out, one clear point at a time; a page of policy language loses people before they reach the signature line. Below is sample wording for two separate moments, recording and later publishing, plus a short retention schedule to pair with them. Keep the two consents as separate forms, or separate sections on one form, so a person can say yes to the first and no to the second.

Wording for recording a prophetic word or testimony

Ask for this consent before anything is written down or switched on, in language short enough to read and sign in under a minute.

Consent to record a prophetic word or testimony

[Name] agrees that the word or story described above, given on [date], may be recorded in writing or on audio by [church name]. [Name] understands this record will be held privately by the pastoral or prophetic ministry team for the purpose of weighing and stewarding it, that a copy will be given to [Name] at the time it is recorded, that [Name] may withdraw this consent and ask for the record to be deleted at any time, and that it will not be shared beyond the team without a further, separate consent.

Signed: _______________ Date: _______________

Wording for publishing a testimony

Ask for this second consent only once you know exactly where the testimony will appear, and never assume it from the first.

Consent to publish a testimony

[Name] agrees that the testimony described above, including any reference to health or another sensitive detail, may be published by [church name] in [website / newsletter / from the stage / social media, delete as needed]. [Name] understands this consent is separate from any earlier consent to record the testimony privately, that it may be withdrawn at any time, and that on withdrawal [church name] will remove or anonymise the published version within [a stated number] of days.

Signed: _______________ Date: _______________

A short retention schedule, reviewed annually, is a useful pair to both forms:

Treat this as a starting point for the church's own schedule, confirmed against current ICO guidance or its denomination's data-protection officer.

FAQ

Do we need consent to record a prophetic word given over someone in a service?

Yes. A prophetic word given over an identifiable person is personal data, and because it usually touches religious belief, it is normally special category data under UK GDPR. Ask before recording, explain what will happen to the record, and get a clear, active yes from the person it concerns.

Is a testimony about healing or an illness special category data?

Almost always. A testimony that describes an illness, a diagnosis, or a physical or mental health change is health data, one of the categories UK GDPR treats as special category data, and a church needs explicit consent to record and to publish it, sought as two separate steps.

How long can a church keep an old testimony?

Only as long as the stated purpose needs it. Set a retention schedule, review it at least annually, and delete or archive records once the purpose has passed. Keeping everything indefinitely in case it is useful someday is the habit to break.

Can someone withdraw consent after a testimony has already been published?

Yes, at any time. UK GDPR expects withdrawal to be about as easy as giving consent was. A church should have a simple way for someone to ask, and should actually remove or anonymise the testimony everywhere it was published: the website, any archive, and anything scheduled to go out next.

---

Keep Reading

• How a Church Keeps a Faithful Record of Prophetic Words
• Prophetic Ministry Guidelines for Churches: A Protocol
• Church App for Prophetic Words: What Most Tools Get Wrong

Doxa helps churches record prophetic words and testimonies, weigh them together against Scripture, and hold the good ones until they come to pass. It is free to start. See how it works for churches, pair it with the free prophecy policy template, or explore the free small-group courses on hearing and weighing the voice of God.