Children’s personal dataPersonal dataAny information relating to an identified or identifiable living person, including identifiers and combinations of data that single someone out. is not a separate regime, but it changes how almost every part of the regime is applied. The questions that matter are who can exercise a child’s rights, what a parent can and cannot see, and what online services must build in.
The rights belong to the child
A child has the same rights as an adult. Where a child is mature enough to understand their rights, they exercise them, and a parent acts only with their authority or where it is in the child’s best interests. There is no fixed age in England, Wales and Northern Ireland; in Scotland a child aged 12 or over is presumed to be of sufficient age and maturity.
When a parent makes a request for a child’s data, ask: is the child capable of understanding the request? If so, does the child consent to the parent acting? Would disclosure be in the child’s best interests? Record the answers.
What a parent cannot see
Several exemptions protect children from their own parents’ access requests:
- Expectations and wishes. Health, social work and education data that the child gave in the expectation it would not be shared with the parent, or asked to be withheld (DPA 2018 Sch 3 paras 4 and 10). A parent can request for a child under 18 in England, Wales and Northern Ireland, under 16 in Scotland.
- Child abuse data. Where disclosure to a parent would not be in the child’s best interests (Sch 3 para 21). This exemption cannot apply in Scotland.
- Serious harm. Where disclosure would be likely to cause serious harm to the child’s physical or mental health (Sch 3 paras 5, 11 and 19).
Consent online
Where an online service offered directly to a child relies on consent, a child aged 13 or over can give it. Below 13, consent must come from a person with parental responsibility, and you must make reasonable efforts to check.
Erasure
Data collected from a child for an online service is a specific ground for erasure, and it continues to apply when that child becomes an adult.
Higher protection by design
Since 2026-02-05 providers of information society services likely to be accessed by children must take account of children’s higher protection matters when designing their processing: how children can best be protected and supported, and their different needs at different ages. The Age Appropriate Design Code’s fifteen standards are the practical form of this, including high privacy by default, no nudging and minimal geolocation.
For a complaint
A child, or a parent acting for one, should frame the request around the child’s interests. An organisation receiving one should decide first whose request it is, then which of the Schedule 3 tests apply, and record both.