Children, Parents and Data Protection: Can I make a complaint on behalf of my child?

There tends to be a general misconception that children do not have the same data protection rights as adults, but this is not the case. The General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (the 2018 Act) apply equally to children and adults. Under Section 29 of the 2018 Act, a child is an individual under the age of 18 years. Although the same data protection principles apply regardless of the age of the child, 0 to 18 years is a broad age range developmentally, and therefore other factors need to be considered. Regardless of the age of the child, it is important for adults to realise that any personal data which relates to their child, is and remains, the personal data of their child. It does not belong to anyone else, such as a parent/guardian and parents/guardians do not have an automatic entitlement to that personal data.

Within the specific context of the online environment (“information society services”), there is even greater protection for children’s data. For example, the digital age of consent is 16 years and any processing of children’s personal data below the age of 16 years is only lawful with the consent of a parent/guardian.

However, this guidance note is not aimed at the online environment, but rather is aimed at assisting parents/legal guardians more generally in understanding the exercise of their children’s data protection rights with entities and organisations in a variety of settings, such as schools, medical facilities or even play centres. 

For more information, see our guidance on Children, Parents and Data Protection: Can I make a complaint on behalf of my child?