Children’s Data – Practical Compliance for Organisations

Many organisations process personal data on children, some inadvertently or peripherally.  

The legal requirements for processing children’s data are critically important for organisations to understand due to regulators’ current laser focus on this area for enforcement action.  

This course provides a comprehensive examination of the legal, practical, and operational responsibilities involved in handling children’s personal data, giving organisations the knowledge and confidence to meet their compliance obligations. Topics covered include: 

• how data protection law defines a “child” and an overview of Data Protection requirements 
• the impact of the Data (Use and Access) Act 2025 on the processing of children’s personal data 
• applying transparency and accountability obligations to online services used by, or accessible to, children 
• selecting and documenting an appropriate legal basis when processing children’s data 
• understanding how the requirements of transparency and accountability apply to online services where children may be involved 
• implementing data protection by design and default for children, including privacyfirst approaches, controls, language, and risk assessment considerations 
• the meaning of “information society service” and its relevance when processing children’s information 
• adapting marketing, automated decision-making, and profiling processes to ensure they remain compliant 
• how parental responsibility operates in practice and how it can be helpful to controllers 
• responding appropriately when a child or parent exercises subject access rights 
• when the Children’s Code applies and the additional obligations it introduces 
• supporting children in exercising their data protection rights and the extra checks organisations should consider 
• practical guidance for controllers who are unsure whether they are processing children’s data 

It is recommended that delegates attending this session have a basic knowledge of current data protection legal requirements. Delegates with no existing knowledge may find it helpful to attend Data Protection Essential Knowledge Level 1 before attending this training course.