A funeral home complies with UK GDPR by knowing exactly what personal data it holds, having a lawful basis for each use, limiting who can see it, keeping it only as long as it needs to, and being able to show all of that on paper. The easiest way to do this day to day is to run arrangements in one system that records who did what, when, and who can see it. That is the thinking behind FuneralDesk, our case management system for UK independent funeral directors.
This guide is for owners, arrangement coordinators and managers of independent funeral homes. It covers the rules in plain terms, retention, software checks and what to do if something goes wrong.
TL;DR
- Information about someone who has died is not personal data, but your records are full of living people: families, informants, payers, next of kin. Those are protected.
- Health and religious details are special category data. You need a lawful basis and a separate Article 9 condition for them.
- The ICO says there are no set retention periods in law. Write your own schedule, with reasons, and review it.
- Software that processes your data makes you the controller. You need a written processor contract and access controls, logs and audit rights.
- A breach that risks people's rights must be reported to the ICO within 72 hours of you becoming aware of it.
Table of Contents
- What personal data a funeral home holds
- Lawful basis and special category data
- Protecting and sharing family information
- How long to keep funeral records
- What UK GDPR changes mean for you now
- Choosing funeral software that supports GDPR
- Where FuneralDesk fits
- Our view
- What to do if there is a data breach
- FAQ
- Sources
What personal data a funeral home holds
UK GDPR protects information about living people. SAIFInsight explains that data on deceased people falls outside the GDPR definitions, yet funeral directors still hold records of names, addresses, dates of birth, religion and services provided. The records that matter are those about the living: the person who instructs you, family members, the payer, the doctor, the celebrant.
Firms' own privacy notices show how wide the range is. One published notice lists names, addresses, dates of birth and death, occupation, cause and circumstances of death, medical information, religious and cultural preferences, family information, photographs and funeral wishes. It states that information relating solely to the deceased is not personal data, while information about living individuals in funeral records stays protected.
A useful first exercise is to map it. Funeral Service Journal advises reviewing what data you hold, where it is stored, who can access it and how it flows in and out of the business. List every place family information lives: the arrangement file, email, phone notes, the order of service draft, payment records, the van sheet, the crematorium forms.
Lawful basis and special category data
Every use of personal data needs an Article 6 lawful basis. For funeral work the usual ones are:
- Contract: taking steps at the client's request before an arrangement, and carrying it out.
- Legal obligation: records you are required to keep.
- Legitimate interests: answering enquiries or keeping your website secure.
These are the bases one Welsh firm sets out in its published policy.
Health information and religious beliefs are special category data. The ICO's guidance says you need both an Article 6 basis and a separate Article 9 condition, and several conditions also need a Data Protection Act 2018 Schedule 1 condition. The ICO also confirms there is no Article 9 condition equivalent to legitimate interests, so legitimate interests alone never covers this kind of data.
In practice many funeral firms rely on explicit consent for religious and health details, used only to arrange the funeral as requested. Searsons Funerals describes consent that is explicit and verified by signature on application forms. Whatever you choose, write it down and make sure your privacy notice matches.
Protecting and sharing family information
The practical rules are short:
- Restrict access to need-to-know. A removals team member rarely needs payment details.
- Secure storage. Paper under lock and key, electronic records password-protected, as SAIFInsight puts it. Funeral Service Journal also recommends encrypted systems for digital and physical records.
- Contracts with third parties. SAIFInsight notes that funeral directors can be controllers in their own right and processors for funeral plan providers, so responsibilities need writing into contracts.
- Keep a record of processing. The ICO's accountability toolkit says a record of processing activities (ROPA) should hold your contact details, purposes, categories of people and data, recipients, transfers abroad, retention schedules and security measures. Good practice is to link it to privacy notices, consent records, contracts and breach records.
Sharing with families is where small firms often slip: emailing a draft order of service with a relative's phone number to the wrong person, or forwarding a whole thread. A secure family portal keeps documents and approvals in one controlled place instead of scattered across inboxes.
How long to keep funeral records
The ICO says there are no set time limits in data protection law. How long you keep data depends on why you hold it. The storage limitation principle means you must not keep personal data longer than needed, must document standard periods in a policy or schedule, and should review and erase or anonymise what you no longer need.
The ICO's records management framework expects the schedule to be reviewed regularly with staff responsibilities assigned. It recommends basing it on business need and statutory requirements, and using systems that tag records with retention dates and prompt for action.
There is one concrete benchmark. In Scotland, the Funeral Director Code of Practice requires a comprehensive record of every deceased person in your care, covering actions such as washing and dressing, where, when and by whom, and arrival and departure times, kept in secure, accessible conditions for at least five years. Where the record contains data about living people, UK GDPR and the Data Protection Act 2018 apply. That Code applies in Scotland, but it is a sensible reference point for a schedule anywhere in the UK.
A workable schedule has three columns: record type, retention period, reason. For example, care records, arrangement files, payment and accounting records, enquiries that did not become funerals, and marketing consents each get their own line.
What UK GDPR changes mean for you now
The Data (Use and Access) Act 2025 amends UK GDPR rather than replacing it. The ICO says all of its data protection provisions were in force by 19 June 2026, and GOV.UK records that most of the Part 5 provisions began on 5 February 2026. Two changes matter for a funeral home:
- Complaints. You must give people a clear route to complain about how you handle their data, acknowledge within 30 days and respond without undue delay, according to Sage's guidance. Update your privacy notice to say how.
- Subject access requests. The ICO's guide says you must reply within one month (extendable by two months for complex requests) and need only make a reasonable and proportionate search. Remote access to a secure system can satisfy a request if the person can download a copy in an accessible format.
The second point is a good reason to keep records in one searchable place rather than across paper files, inboxes and spreadsheets.
Choosing funeral software that supports GDPR
If software processes family data for you, you are the controller and the supplier is your processor. The ICO's data security guide says you must choose a processor giving sufficient security guarantees and have a written contract requiring Article 32 security measures and making available the information needed to show compliance, including audits.
Article 28 adds that the contract must require processing only on your documented instructions, confidentiality of authorised staff, help with data subject rights requests, and deletion or return of all personal data when the service ends, unless UK law requires storage.
Against that, a checklist for any system:
| Check | Why it matters |
|---|---|
| Written processor contract covering Article 28 terms | Legal requirement for the controller |
| Role-based access, with end dates when staff leave | The ICO expects access limited to authorised staff and reviewed when people change role or leave |
| Log of user access to records | The ICO recommends a log of access to systems holding personal data |
| Retention dates and prompts | Supports your schedule and storage limitation |
| Return or deletion of data at contract end | Article 28 requirement |
| Records you can export for a SAR | One-month deadline |
All of the access control points come from the ICO's records management framework, which warns that failing here risks breaching UK GDPR Articles 5(1)(f) and 32. The ICO has also said it is drafting updated guidance on controller and processor contracts, with consultation due in January 2027 and a final version in Spring 2027, per its guidance plans page, so review your contract terms when it lands.
Where FuneralDesk fits
FuneralDesk is a cloud-based case management system built for UK independent funeral directors. Its care of the deceased audit trail records care activities and legal requirements in real time, and its audit logs are designed to meet sector regulations. That is the kind of record the Scottish Code describes: what was done, where, when and by whom. Family communication runs through a secure portal, payments run online, and one-click inspection packs are part of the platform.
It also removes admin that creates data risk. AI-drafted letters and estimates are produced inside the case rather than in loose documents, and the calendar is shared with Microsoft 365. Multi-brand support helps groups that run several trading names.
Plans are £149 per month per branch or £1,500 per year per branch, as published on the FuneralDesk site, and start with a personal demo and onboarding.
Our view
Most GDPR trouble in funeral homes is not malice. It is a busy week, a family on the phone, and information that ends up in five places.
We built FuneralDesk around one idea: every arrangement is one record, with the care activity, documents, payments and family messages in the same place, and a trail of who touched what. When access, retention and evidence live in the system rather than in someone's memory, compliance stops being a separate project.
The firms that cope best with the new complaint and access request rules are the ones who can find a family's information in minutes. That is what a purpose-built system is for.
Kev
What to do if there is a data breach
A breach means destruction, loss, alteration, or unauthorised disclosure of or access to personal data. Article 33 requires you to notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in risk. Late reports need reasons. Every breach must be documented with its facts, effects and remedial action. Article 34 requires you to tell affected people without undue delay where the risk to them is high.
Agree in advance who decides, who calls the ICO and where the breach log lives. If you are unsure whether a breach is reportable, speak to the ICO or a data protection adviser straight away rather than waiting.
FAQ
Does GDPR apply to a funeral home if the deceased are not covered?
Yes. Information relating solely to the deceased is outside UK GDPR, but your records also hold details of living relatives, payers and contacts. Those are personal data and you are the controller for them.
How long should a funeral home keep records?
There is no fixed legal period under data protection law. You set periods based on need and legal requirements, document them and review them. The Scottish Code of Practice sets a five-year minimum for care records in Scotland, a useful reference elsewhere.
Do I need consent to record religious or health information?
You need a lawful basis plus an Article 9 condition. Explicit consent is the one many funeral firms use, usually signed on the arrangement form. Legitimate interests alone is not enough for this data.
What should my software supplier agree in writing?
A processor contract covering Article 28 terms: documented instructions, confidentiality, Article 32 security, help with rights requests, return or deletion of data at the end, and audit access.
Sources
- GDPR: a complex puzzle, SAIFInsight
- Privacy Notice, Deborah Mitchell Funeral Services
- What GDPR means for funeral businesses, Funeral Service Journal
- Privacy & Cookies, Penybont Funeral Services
- Special category data, ICO
- When can we rely on legitimate interests, ICO
- GDPR Policy, Searsons Funerals
- Records of processing and lawful basis, ICO
- Data storage advice, ICO
- Storage limitation, ICO
- Records management and security, ICO
- Funeral Director Code of Practice, Scottish Government
- The Data Use and Access Act 2025, ICO
- Data Use and Access Act 2025: plans for commencement, GOV.UK
- UK data protection changes in 2026, Sage
- A guide to subject access, ICO
- A guide to data security, ICO
- UK GDPR Article 28, legislation.gov.uk
- ICO plans for new and updated guidance
- UK GDPR Articles 33 and 34, legislation.gov.uk