Max Penalty
£17.5m or 4% of global turnover
Governs how organisations process personal data, including children's data. Establishes the framework for the Children's Code (AADC). Requires high standard of protection for children's data, with age-appropriate privacy notices and legitimate interest assessments.
Key Points
Children cannot consent to data processing below age 13 in the UK
Data controllers must verify age where services are directed at children
Privacy notices must be written in language children can understand
Data Protection Impact Assessments (DPIAs) required for high-risk processing
Right to erasure ("right to be forgotten") applies to childhood data
Guardian AI
AUREN chat is temporarily offline for scheduled improvements. Please check back soon.
For immediate help: • 999 — if someone is in immediate danger • Childline: 0800 1111 — free, confidential support • CEOP — ceop.police.uk for online exploitation
You can also browse our guides directly via the menu.