Article 91 Existing data protection rules of churches and religious associations

This article carves out a specific accommodation for churches and religious associations that already had their own comprehensive data protection rules in place when the GDPR came into force.

Rather than requiring these bodies to discard their existing frameworks, the article permits those rules to continue operating, on the condition that they are brought into alignment with the GDPR.

Crucially, this privilege comes with an oversight requirement: these bodies must be supervised by an independent supervisory authority, which can be one specific to them, but must meet the standards set out in Chapter VI of the Regulation governing supervisory authorities.

Important points:

• Churches and religious associations with pre-existing comprehensive data protection rules may continue to apply them, provided those rules are brought into line with the GDPR.
• These bodies must be subject to supervision by an independent supervisory authority — a dedicated one is permitted, but it must meet the conditions of Chapter VI of the Regulation.
• This article acts as a limited exception within the broader GDPR framework, not an exemption from it.