Church safeguarding records

Who says a church must keep safeguarding records

Three layers of expectation sit on a church, and their legal weight differs. The first is the statutory guidance. Working Together to Safeguard Children 2026 says that "every VCSE, faith-based organisation and private sector organisation or agency should have policies in place to safeguard and protect children from harm. These should be followed, and systems should be in place to ensure compliance in this" (paragraph 358). The next paragraph asks every faith-based organisation to have in place the arrangements set out for statutory agencies, which include "arrangements which set out clearly the processes for sharing information" and "a designated practitioner" for child safeguarding, and it notes that religious organisations are within the Relevant Agency Regulations, so a church the local safeguarding partners name as a relevant agency must co-operate with them.

The second is charity law. Most churches are charities, registered or not, and the Charity Commission's guidance Safeguarding and protecting people for charities and trustees expects trustees to make sure the charity "keeps accurate records" and, when an incident happens, to "handle and record it in a secure and responsible way". For a parish church the trustees are usually the parochial church council; for a Methodist church, the church council; for an independent church, whoever its governing document names as trustees or elders.

The third is the denomination, and this is where the detail lives:

• Church of England. The Safeguarding (Code of Practice) Measure 2021 requires the House of Bishops to issue a code of practice "for relevant persons on safeguarding children and vulnerable adults", and says "a relevant person must, accordingly, comply with a requirement imposed on that person by the code". Relevant persons include clergy, churchwardens, parochial church councils, licensed readers and lay workers. The requirements, and the House of Bishops' guidance to which relevant persons must have due regard, are collected in the Safeguarding e-manual.
• Methodist Church in Britain. The connexional Safeguarding Policy, Procedures and Guidance applies to every church, circuit and district, with model church and circuit policies to adopt locally. Its section 4.2 sets out how to record.
• Catholic Church in England and Wales. Dioceses and religious congregations are accountable to the Catholic Safeguarding Standards Agency, set up in 2021, which audits them against eight national safeguarding standards, including the effective management of allegations and concerns. Parishes follow their diocese's procedures and pass concerns to the diocesan safeguarding office.
• Independent and free churches. A church with no denominational framework carries the first two layers alone, plus any rules of a network or union it belongs to. Many adopt a model policy from a Christian safeguarding charity such as thirtyone:eight and follow the NSPCC's recording and retention guidance; the duty is the same even where nobody audits it.

None of these frameworks treats safeguarding records as optional, and none accepts "we are only volunteers" as a reason for keeping fewer of them. Working Together says it plainly: practitioners in these organisations are "subject to the same safeguarding responsibilities, whether paid or a volunteer" (paragraph 357).

The records a church keeps

A parish or congregation does not keep a case file in the way a diocese or a denomination's safeguarding team does, but it does keep more safeguarding records than most church councils realise. The usual set is:

• Concern and disclosure records: every worry about a child or an adult, however small, written down by the person who received it and passed to the church's safeguarding officer.
• Allegations about church officers: concerns about clergy, lay ministers, youth leaders, organists, bell-ringers, stewards and volunteers, which go to the diocesan safeguarding team (in the Methodist Church, the Regional Officer for Safeguarding) and, where the person works with children, to the local authority designated officer (LADO).
• Arrangements for people who may pose a risk: where someone with a relevant conviction or allegation attends worship, the written agreement setting out the conditions, who supports and monitors it, and when it is reviewed. The Methodist Church calls this a safeguarding contract (formerly a Covenant of Care); the Church of England and Catholic dioceses have their own equivalents.
• Safer recruitment records: role descriptions, applications, references, the record of the criminal records check (the date, level and certificate number, not a copy of the certificate) and the decision to appoint.
• Training records: who has done which level of the denomination's safeguarding training, and when the refresher is due.
• Activity records: registers for children, young people's and youth groups showing which leaders and helpers were present, parental consents, risk assessments for trips and residentials, and the hirer's confirmation that a group using the hall has its own policy.
• Governance records: the adopted policy with its review date, church council minutes that receive the safeguarding officer's report, the annual safeguarding return or audit, and any serious incident report to the Charity Commission.

Pastoral care is the grey area. A minister's notes of a pastoral visit are not a safeguarding record until something in them raises a concern, and then the relevant part has to be written up and passed on like any other concern. The same applies to what is said at a prayer ministry session, a bereavement visit or over coffee after the service. Churches whose policy does not say this tend to find that concerns about adults, which are harder to recognise, are the ones that were never written down.

What a good church safeguarding record contains

The denominational guidance agrees on the essentials, and each adds something worth knowing. The Church of England's e-manual requires the person receiving a disclosure to "make a written record of the disclosure and inform the person making the disclosure that is what is being done", and adds that "the record must be signed by the person receiving the allegation, timed and dated and it must include the location or the means (in person, online, phone call) through which the allegation was received". That last requirement matters more each year: a concern raised in a text or on social media is recorded as having been received that way.

The Methodist policy asks for notes taken during the conversation where possible, and for the record to set out who was involved, where, when, how and in what context, including "any connections between the parties, particularly where the connection resulted in a power differential", which in a church is often the point. It asks for exact words in quotation marks, "Use the person's own words and phrases. Do not attempt to sanitise language or improve grammar", and for notes that are "up to date, signed, dated and timed".

The NSPCC's records retention and storage guidelines (updated September 2026) give the list most independent churches use: the date and time of the incident and of the report, who first received it and who is reporting it, everyone involved including witnesses, the child's details, what was said or done and by whom, what action was taken, any referral, and "the reasons why the organisation decided not to refer those concerns to a statutory agency (if relevant)". They add that the report should be "as factual as possible", with any interpretation "clearly reported as such".

The joint Church of England and Methodist practice guidance on safeguarding records, published in 2015, puts the underlying rule in one line: records "should clearly differentiate between facts, opinion, judgements and hypothesis". It also explains why churches in particular need them: to "allow for continuity when there is a change of personnel". A new incumbent or minister arriving in a parish or circuit inherits the concerns of the last one only if they were written down.

Passing it on, and where the file lives

Each denomination sets a clock and a route. In the Church of England, where there is no immediate risk, the e-manual says "the matter must be referred to the police or social services and the relevant PSO or Safeguarding Officer within one working day", and "in all cases, all records that have been made must be included with the referral". The parish safeguarding officer (PSO) and the incumbent work with the diocesan safeguarding team, which holds the case. In the Methodist Church, the policy says to "pass records to the DSO as soon as possible but at the latest by noon of the next day", a reference the Methodist Church said in May 2026 should now be read as its Regional Officer for Safeguarding (ROS), and the church safeguarding officer is to "record all safeguarding issues that are reported". In a Catholic parish the route is to the diocesan safeguarding office, following that diocese's procedure. In every denomination, a child or adult in immediate danger means the police first.

In an independent church the route is shorter and less supported: the church's designated safeguarding person, and then children's or adults' social care or the police. Without a diocese or a denominational safeguarding officer to hold the case, the church itself holds the whole file, and the trustees need to be sure it is kept as carefully as a diocese would keep it.

That split between the local church and the wider body shapes where records live. Following the joint guidance, safeguarding records "should only be seen by those who need to have proper access to them", paper files belong in a lockable cabinet and electronic files should be password-protected and backed up, so that confidential information is stored securely whoever holds it. There should be "a written protocol about who has access to the records and how records are accessed in an emergency or in planned or unplanned absences of the record holder". In practice the parish or congregation keeps its own concern forms, registers and recruitment records; the diocese, or for a Methodist church the Regional Officer for Safeguarding, keeps the case file and the risk assessment. Many churches have no office, so the safeguarding officer keeps the records at home, which is acceptable only if the policy says where, how they are secured and who takes over responsibility for them when that person steps down.

Concerns about adults follow the same discipline. Where an adult with care and support needs is at risk of abuse or neglect, the local authority's adult safeguarding duties under the Care Act 2014 apply, and the church's record is what it will ask for. A church's pastoral relationships with older and isolated people mean that financial abuse, coercive control and self-neglect often surface there first.

Two changes in the criminal law bear on what a church records. Since June 2022, a person who regularly teaches, trains, supervises or instructs a young person under 18 "in a sport or a religion" is in a position of trust under section 22A of the Sexual Offences Act 2003, which covers youth leaders, confirmation tutors and choir leaders as much as clergy. And the Crime and Policing Act 2026 creates a duty for people in regulated activity with children to report child sexual abuse they are told about or witness to the police or the local authority. That duty needs commencement regulations and guidance before it applies, so check its status, but when it does the church's record of when a disclosure was made and to whom will be the evidence that the duty was met.

Data protection and how long records are kept

Church records carry an extra layer of sensitivity. Under Article 9 of the UK GDPR, data revealing "religious or philosophical beliefs" is special category data, so even a youth group register can be special category data for a church. Article 9(2)(d) lets a not-for-profit body with a religious aim process its members' data in the course of its legitimate activities, but only on condition that it is "not disclosed outside that body without the consent of the data subjects". Safeguarding sharing therefore relies on a different condition, and the one most often used is paragraph 18 of Schedule 1 to the Data Protection Act 2018, safeguarding of children and of individuals at risk, which allows processing without consent where consent cannot be given, cannot reasonably be obtained or would prejudice the protection. The Data (Use and Access) Act 2025 has amended UK GDPR and the 2018 Act, with all its data protection changes now in force while the ICO reviews some of its guidance, so check the date on any ICO guidance on special category data you rely on. Record what was shared, with whom and why.

Retention is set by the denomination first. As part of its records management guidance the Church of England publishes a Record Retention Schedule, updated in May 2026, which now incorporates the safeguarding records retention schedule approved in March 2024 and replaces the old "Keep or Bin" guidance. The Methodist Church publishes retention schedules alongside its policy. Catholic dioceses set their own under the national standards. Church retention periods for safeguarding case records are long, often measured in decades, because allegations about church officers are frequently made many years after the event. Take the period from the current schedule rather than from a parish handbook that may be several editions old.

Independent churches without a schedule usually adopt the NSPCC's approach, which asks for set retention periods and points to the education rules as the usual reference; our youth club safeguarding records guide sets those periods out, and a church that closes should, in the NSPCC's words, "make arrangements for the ongoing management of records".

The concern that is first raised by text

Now follow a concern through an ordinary church. A helper at the Friday youth group messages the leaders' group chat at ten at night: "Did anyone else think J was really quiet tonight? He flinched when Mark put a hand on his shoulder." Two other helpers reply. On Saturday the youth leader forwards it to the vicar, who is on retreat and replies "thanks, let's talk Monday". A member of the congregation texts the churchwarden about an elderly man whose new lodger now collects his pension. The safeguarding officer, when she finally hears, writes a record that begins "On Monday I was made aware…", and the first raising, the words used, the time and the two who agreed, sits on four personal phones.

Each of those messages is part of the safeguarding record the denominations describe. The Church of England requires the record to state the means by which a concern was received; the Methodist policy asks for exact words and the timing; the NSPCC's guidelines say that staff and volunteers "should never use their own devices to make and store records unless there is a clear reason established by the organisation". A church cannot produce messages held in an app it does not run, on phones it does not own, belonging to volunteers who may have moved on by the time the diocese, the LADO or an inquiry asks what was said and when.

Safeguarding concerns reach churches this way because that is how congregations talk. Churches cannot stop people using their phones; for many congregations the leaders' group chat is how the rota, the lifts and the Sunday school run at all. What they can decide is where concerns are raised. ComplyChat gives a church a channel it controls, in which everyone added is told the channel is on the record and can object or leave, and in which messages are recorded on the server as they are sent. On paid plans, a volunteer, churchwarden or parent with no church email account can join with a mobile number verified by SMS, and once the church's Microsoft 365 tenant is connected, the lasting record files into that tenant under the church's own retention rules. ComplyChat is not a safeguarding case management system and does not replace the route to the parish safeguarding officer, the diocese, the Regional Officer for Safeguarding or the police; it is somewhere the first message lands where the church can later find it.

A question for the next church council or PCC meeting: if a concern were first raised tonight in the leaders' group chat, would the church be able to produce that message in five years' time, and whose phone would it have to ask for?

Official guidance and your next step

The primary sources are Working Together to Safeguard Children 2026 (paragraphs 354 to 359 on voluntary and faith-based organisations), the Charity Commission's safeguarding guidance for trustees, your denomination's framework (the Church of England's Safeguarding e-manual, the Methodist Safeguarding Policy, Procedures and Guidance, or your Catholic diocese's procedures under the national standards) and the NSPCC's records retention and storage guidelines. Quotations are from those documents as read in September 2026. Churches in Wales, Scotland and Northern Ireland follow their own national guidance and, often, their own denominational procedures.

This guide is a practical summary for churches in England, not legal advice and not a substitute for your diocesan, regional or denominational safeguarding team, who should be your first call on any individual case.

Then do one thing: ask your safeguarding officer to show the church council where the last three concern records are kept, who else could open them tomorrow if the officer were ill, and whether each shows how and when the concern first reached the church.