Family historians work with personal information every day, so it is natural to ask whether data protection law applies to your tree. For most of your research the answer is reassuring: the law does not cover the dead. The difficulty is the living, and in particular what happens when a tree containing living relatives is published on the internet. (This is general information, not legal advice.)
Quick answer
UK GDPR only protects identifiable living people, so information about your ancestors is outside it. Keeping living relatives in a tree for your own use falls under the "purely personal or household" exemption. Publishing living people on a public website is different: courts have held that putting personal data online for an unlimited audience is not a purely personal activity. The safe approach is to hide living people from public view, publish them only with consent, and remove details promptly if asked.
In this guide
The dead are not covered
The Information Commissioner's Office is clear: UK GDPR "only applies to information which relates to an identifiable living individual." Your great-great-grandparents' baptisms, censuses and burials, and everything you write about them, are outside data protection law.
That does not mean anything goes. Copyright, defamation of the living through what you say about the dead, and plain courtesy to descendants still apply. But the core of family history is not a GDPR question.
The living are covered
A living relative's name, date of birth, address, photograph or relationships are personal data. Two exemptions and rules decide what that means for you.
The household exemption
UK GDPR does not apply to processing "by an individual in the course of a purely personal or household activity". Researching your family on your own computer, keeping living relatives in a private tree, and sharing it with close family all fall comfortably within it.
Publishing online is different
The leading case is Lindqvist (Court of Justice of the European Union, 2003). A church volunteer published details of fellow parishioners on a personal web page. The court held that naming people on an internet page is processing personal data, and that the household exemption does not cover publication on the internet where the data is made accessible to an indefinite number of people. UK GDPR words the exemption in the same way, and Lindqvist remains the standard reference on the point.
For a family historian, the practical reading is:
| What you do | Likely position |
|---|---|
| Private research tree on your computer or a private online tree | Household exemption applies |
| Sharing a file with a few close relatives | Household exemption very likely applies |
| Public website showing living relatives | Outside the household exemption; UK GDPR applies |
| Public website showing only people who have died | Not personal data; UK GDPR does not apply |
| Members-only site restricted to invited family | Grey area; the smaller and more private, the stronger your position |
| Professional or society website | UK GDPR applies; take advice |
What applies if you do publish living people
If UK GDPR applies, you become a "controller" with duties, including:
- A lawful basis, in practice usually the person's consent.
- Transparency: people should know you hold and publish their details.
- Accuracy, and correcting errors when asked.
- Their rights, including the right to object and to have their details removed.
For most family websites, meeting these duties for every living cousin is harder than simply not publishing them.
Take extra care with sensitive details
Some information about living people is "special category data" with stricter rules, including health, religion, ethnicity and genetic data. Family trees and research notes often touch all four: causes of death that run in families, adoptions, religious records and, above all, DNA results. DNA matches reveal information about living relatives who never took a test. Keep them out of public view.
A practical checklist for family tree websites
- Hide living people from the public automatically. Treat anyone born within the last 100 years with no death recorded as living.
- Check your notes and stories, which privacy filters do not read. A biography can name living grandchildren.
- Ask before publishing a living person, and keep a note of their agreement.
- Put living branches behind a login if relatives want to see them.
- Add a short privacy notice saying how people can ask for corrections or removal.
- Act quickly on requests. Remove details first and discuss later.
- Keep DNA results private.
We cover the practical side in how to protect living relatives in an online family tree.
How AncestorPress handles living people
AP Family Trees shows anyone without a death date who was born in the last 100 years as "Living", honours privacy flags in your GEDCOM file, and lets you mark people by hand. AP Family Archive never shows living or private people to visitors, on any page or download, and the setting cannot be switched off. The details stay in your own database, visible to you when signed in.
Outside the UK
The EU GDPR takes the same approach as UK GDPR, and Lindqvist is an EU case. In the United States there is no general federal privacy law covering family trees, but the same courtesy, and the risk of identity theft, apply everywhere.
Frequently asked questions
Does GDPR apply to family history research?
Only to information about living people. Research about people who have died is outside UK GDPR.
Can I put living relatives in my family tree?
Yes, for your own research. The household exemption covers private research. The issue is publishing them where anyone can see.
Do I need consent to publish a living relative online?
In practice, yes. Consent is the clearest lawful basis for publishing a living person's details on a public site.
Is a members-only family website covered by GDPR?
It depends how private it really is. A small site restricted to invited family is closer to the household exemption than a public one, but it is not guaranteed. Hiding living people is the safest approach.
A relative asked me to remove them. Must I?
If you publish living people, you should act on the request. Remove their details promptly.
Publish your tree safely
AP Family Trees and AP Family Archive hide living relatives from visitors automatically, so your family history website stays on the right side of the line.
Disclosure: AncestorPress makes WordPress genealogy plugins that hide living people automatically. This article is general information, not legal advice. If you run a commercial or society website, or receive a complaint, take advice from a qualified professional. Last checked September 2026.