Data Protection & Freedom of Information Office

Rights of Children and Vulnerable Adults

Recital 38 of the GDPR states that "children merit specific protection specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data". This "specific protection" also applies to vulnerable adults.

Under the UK Data Protection Act 2018, children of thirteen or older have the same rights to control and access their personal data as adults, subject to assessment.

If you are obtaining consent to process the personal data of children or vulnerable adults, ensure that you tailor your language so it is clear and understandable to them. If you are seeking the consent of a parent or guardian acting on behalf of children or vulnerable adults, you should still make the data subject aware that their data will be processed. Ensure that any information you present to them is tailored to the audience.