GDPR children's data and special-category checks

Do not start with a single label such as sensitive users or vulnerable data. First decide whether the service is offered directly to a child and relies on consent under Article 6(1)(a). Then decide whether any data falls into Article 9 categories such as health data, genetic data, biometric data used for unique identification, political opinions, religion, trade union membership, sex life, or sexual orientation.

Article 8 does not create a universal age gate for every child-related processing activity. It applies to consent for information society services offered directly to children. Article 9 is broader: if a listed special category is processed, the team must identify a condition in Article 9(2) and keep the supporting law, consent record, safeguard, or operational evidence.

When Article 8 applies, the controller must make reasonable efforts to verify that consent is given or authorised by the holder of parental responsibility, taking available technology into account. The evidence should show what was checked, why the method was proportionate to the risk, and why it did not collect more personal data than needed.

Do not publish a country-by-country age table unless the relevant Member State rule is grounded. A safer artifact records the default GDPR age of 16, flags that Member States may lower it to no less than 13, and requires Member State legal confirmation before launch in a specific Member State.

Article 9 begins with a prohibition. Processing is allowed only where a listed condition applies, such as explicit consent, employment and social protection law, vital interests where the person cannot consent, legitimate activities of certain non-profit bodies, data manifestly made public by the data subject, legal claims, substantial public interest under law, health or social care conditions, public-health interest, or archiving, research, or statistical purposes with Article 89 safeguards.

The condition is not enough on its own when the text requires Union or Member State law, professional secrecy, suitable and specific measures, or Article 89 safeguards. The implementation record should identify those safeguards in operational terms: access limits, separation of duties, retention limits, purpose boundaries, security controls, staff confidentiality, and review ownership.

A DPIA is required before processing that is likely to result in a high risk to natural persons. Article 35 specifically calls out large-scale Article 9 processing, large-scale Article 10 processing, systematic and extensive automated evaluation that significantly affects people, and large-scale systematic monitoring of publicly accessible areas.

For child and special-category workflows, the DPIA screen should also look for vulnerability, sensitive data, large scale, innovative technology, profiling, monitoring, data matching, and residual high risk. If several criteria apply, document the DPIA decision rather than treating it as a privacy-office preference.

Article 12 requires concise, transparent, intelligible, and easily accessible information using clear and plain language, especially where information is addressed to a child. A child-facing notice should explain the controller, purposes, data categories, consent choices, withdrawal, rights, retention, sharing, and safeguards in language that matches the intended audience.

The internal evidence should match the external notice. If the notice says location data is optional, the consent log, product settings, DPIA, and access-control record should prove that it is optional. If a special-category condition depends on law or professional secrecy, the evidence should identify that law, role, or confidentiality control.