# GDPR Article 91: Existing Data Protection Rules of Churches and Religious Associations

- Source: https://support.icompaas.com/support/solutions/articles/62000236438-gdpr-article-91-existing-data-protection-rules-of-churches-and-religious-associations
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GDPR](https://support.icompaas.com/support/solutions/62000112722) › [Chapter IX: Provisions Relating to Specific Processing Situations](https://support.icompaas.com/support/solutions/folders/gdpr-chapter-9-specific-processing-situations)
- Last updated: 2026-07-11
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Overview**

This article allows churches and religious associations to continue applying their existing data protection rules, provided that these rules are aligned with GDPR. These entities must remain subject to supervision by an independent supervisory authority that meets the conditions set out in the Regulation.

  

### **Key Principles**

-   Autonomy: Churches and religious associations may maintain their own data protection rules.
    
-   Alignment with GDPR: Existing rules must comply with GDPR principles and requirements.
    
-   Independent Supervision: Entities must be overseen by a supervisory authority that satisfies GDPR conditions.
    
-   Accountability: Supervisory authority ensures compliance and protection of data subjects’ rights.
    
-   Transparency: Supervisory oversight guarantees that personal data handling aligns with regulatory standards.  
      
    

### **Organizational Applicability**

This article applies to:

-   Churches and religious associations processing personal data.
    
-   Independent supervisory authorities monitoring compliance within these organizations.
    
-   Legal and compliance teams managing alignment between internal rules and GDPR.
    
-   Members, employees, or stakeholders whose data is processed by these entities.  
      
    

### **Implementation Requirements**

-   Maintain existing data protection rules while ensuring GDPR alignment.
    
-   Submit to supervision by an independent supervisory authority compliant with GDPR.
    
-   Document processing activities and safeguards applied to personal data.
    
-   Ensure mechanisms exist for oversight, audits, and compliance reporting.  
      
    

### **Implementation Guidance**

-   Periodically review internal rules for alignment with GDPR obligations.
    
-   Train staff on GDPR principles and supervisory authority requirements.
    
-   Establish communication channels with the supervisory authority for guidance and reporting.
    
-   Implement procedures to monitor, document, and enforce compliance.  
      
    

### **Periodic Review**

-   Frequency: Annually or when GDPR obligations or internal rules are updated.
    
-   Responsible Role: Compliance Team, Data Protection Officer (DPO), or Legal.
    
-   Outcome: Ensure continued lawful and GDPR-aligned data protection within churches and religious associations.  
      
    

### **Non-Compliance Risks**

-   Fines: Up to €20 million or 4% of global annual turnover for GDPR violations.
    
-   Legal Exposure: Liability for processing personal data outside the scope of supervision or GDPR compliance.
    
-   Reputational Damage: Loss of trust among members, stakeholders, and the public.
    
-   Operational Risk: Misalignment with GDPR may lead to regulatory scrutiny or enforcement actions.

## Related compliance guidance

- [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): How the Regulation fits together as a programme — lawful bases, Article 28/30/32/33 obligations, transfers and the DPIA process.
- [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): If you also serve users in India, the DPDP Act borrows GDPR concepts but differs on consent, breach reporting and transfers.