Apply Article 8 and Article 9 without turning every sensitive workflow into a generic consent exercise.
This guide helps record age and parental-consent checks, special-category conditions, DPIA triggers, child-facing transparency, safeguards, and evidence for product, privacy, legal, security, support, HR, and vendor teams.
Children's data and special-category data are separate GDPR checks that often appear in the same product or business process. Article 8 adds conditions when consent is the Article 6 basis for an offered directly to a child. Article 9 starts from a prohibition on processing and then asks whether a specific Article 9(2) condition, safeguards, and evidence support the processing.
Start with two separate decisions. First decide whether the service is offered directly to a child and relies on consent under Article 6(1)(a). Then decide whether any data falls into Article 9 categories such as health data, genetic data, biometric data used for unique identification, political opinions, religion, trade union membership, sex life, or sexual orientation.
Article 8 does not create a universal age gate for every child-related processing activity. It applies to consent for information society services offered directly to children. Its consent rule is also separate from Member State contract law on whether a child can form, validate, or be bound by a contract. Article 9 is broader: if a listed special category is processed, the team must identify a condition in Article 9(2) and keep the supporting law, consent record, safeguard, or operational evidence. Personal data about criminal convictions and offences is governed separately by Article 10, not treated as an Article 9 special category.
Biometric data is an Article 9 special category when it results from specific technical processing of physical, physiological, or behavioural characteristics and is used to allow or confirm unique identification. A photograph or voice recording is not automatically special-category biometric data, although it remains personal data when it relates to an identifiable person and another Article 9 category may still be revealed.
Sources (1)
Primary legal text for Article 8 children's consent, Article 9 special-category processing, Article 12 transparency, and Article 35 DPIA triggers.
Conditions applicable to child's consent
Article 9 begins with a prohibition. Processing is allowed only where a listed condition applies, such as explicit consent, employment and social protection law, vital interests where the person cannot consent, legitimate activities of certain non-profit bodies, data manifestly made public by the data subject, legal claims, substantial public interest under law, health or social care conditions, public-health interest, or archiving, research, or statistical purposes with Article 89 safeguards.
The condition is not enough on its own when the text requires Union or Member State law, professional secrecy, suitable and specific measures, or Article 89 safeguards. The implementation record should identify those safeguards in operational terms: access limits, separation of duties, retention limits, purpose boundaries, security controls, staff confidentiality, and review ownership.
Sources (1)
Article 9 lists the special categories, the prohibition, the exceptions, and the extra Member State flexibility for genetic, biometric, and health data.
Processing of special categories
A DPIA is required before processing that is likely to result in a high risk to natural persons. Article 35 specifically calls out large-scale Article 9 processing, large-scale Article 10 processing, systematic and extensive automated evaluation on which decisions are based that produce legal or similarly significant effects, and large-scale systematic monitoring of publicly accessible areas.
For child and special-category workflows, the DPIA screen should also look for vulnerability, sensitive data, large scale, innovative technology, profiling, monitoring, data matching, and residual high risk. If several criteria apply, document the DPIA decision rather than treating it as a privacy-office preference.
Sources (3)
Article 35 sets the DPIA threshold and explicitly includes large-scale special-category processing.
likely to result in a high risk
DPC guidance supports using DPIAs to identify and mitigate data-protection risks early, documenting risk decisions, and involving project, DPO, processor, and data-subject perspectives where appropriate.
mandatory for any new high risk
CNIL methodology supports the structured PIA record: context, fundamental principles, data-security risks, controls, validation, and monitoring over time.
define and describe the context
Article 12 requires concise, transparent, intelligible, and easily accessible information using clear and plain language, especially where information is addressed to a child. A child-facing notice should explain the controller, purposes, data categories, consent choices, withdrawal, rights, retention, sharing, and safeguards in language that matches the intended audience.
The non-public evidence should match the external notice. If the notice says location data is optional, the consent log, product settings, DPIA, and access-control record should prove that it is optional. If a special-category condition depends on law or professional secrecy, the evidence should identify that law, role, or confidentiality control.
No. Article 8 applies where consent under Article 6(1)(a) is used for an offered directly to a child. Member States may set a lower age for that purpose, but not below 13. Verify and record the applicable Member State provision before configuring the consent threshold.
No. Article 9(2)(a) is one possible condition, but the GDPR says Union or Member State law may provide that the Article 9 prohibition cannot be lifted by consent. The team must also satisfy Article 6 and any required safeguards, notice, withdrawal, minimisation, retention, and security controls.
A DPIA is required where processing is likely to result in high risk. Article 35 specifically requires one for large-scale special-category processing, and DPIA screening should escalate when child users, vulnerability, profiling, monitoring, innovative technology, large scale, or residual high risk are present.
Sources (2)
Article 12 supports child-appropriate transparency, and Articles 13, 14, 15 to 22, and 34 connect notice, rights, and breach communications.
clear and plain language
CNIL templates support recording consent controls, rights controls, security controls, risk treatment, and validation evidence.
controls for obtaining consent
Sorena can help convert the checks on this page into cited questions, owner assignments, evidence requests, consent records, DPIA screens, and review triggers for EU GDPR work.
Ask cited questions about Article 8, Article 9, DPIA triggers, transparency, safeguards, and evidence using the sources on this page.
Review a child-facing service, special-category workflow, consent design, DPIA screen, or evidence pack with Sorena.
"protection of personal data"
"Conditions applicable to child's consent"
"reasonable efforts to verify"
"Processing of special categories"
"likely to result in a high risk"
"clear and plain language"
"clear and plain language adapted to the target user"
"controls for obtaining consent"
"identify and mitigate"
"mandatory for any new high risk"
"define and describe the context"
"continuous improvement process"
A concrete GDPR scope test for personal data, controller and processor roles, EU establishment, EU targeting or monitoring, special-category and child data, transfers, vendors, and evidence.
This GDPR Article 30 RoPA intake workflow helps capture controller and processor fields, owners, transfers, retention, security measures, and evidence before a processing activity goes live.
GDPR guide to profiling and Article 22 decisions: scope, transparency, lawful basis, DPIA triggers, safeguards, human intervention, challenge rights, and evidence.
EU GDPR breach notification workflow covering awareness, 72-hour supervisory authority notices, processor escalation, high-risk data-subject communication, delay reasons, and evidence logs.
A concrete EU GDPR breach notification workflow for detecting and triaging incidents, starting the awareness clock, assessing risk, notifying authorities or data subjects, and keeping Article 33 records.
This GDPR checklist helps review scope, lawful basis, notices, DSAR handling, DPIAs, RoPA, processor contracts, SCC transfers, breach notification, retention, security, and evidence.
Practical EU GDPR compliance guide for mapping scope, lawful basis, notices, data-subject rights, DPIAs, RoPA, processor terms, breaches, transfers, retention, security, and penalties.
Classify GDPR controllers, processors, and joint controllers from actual decision-making, then document Article 26 allocation, Article 28 terms, instructions, and vendor evidence.
GDPR rights-request workflow for intake, identity checks, request scope, the one-month response clock, extensions, refusals, processor coordination, and evidence.
EU GDPR calendar for calculating rights-request deadlines, breach notification, DPIA and prior-consultation gates, transfer reviews, and retention checks.
Screen high-risk processing, run a GDPR Article 35 DPIA, record mitigation, and identify when Article 36 prior consultation is required.
EU GDPR DPIA guide covering Article 35 triggers and contents, CNIL and DPC PIA methods, residual risk, mitigation records, and prior consultation limits.
Run a GDPR DSAR workflow for intake, identity checks, rights scoping, one-month response timing, extensions, refusals, processor handoffs, and evidence records.
Direct EU GDPR FAQ answers on scope, controller and processor roles, lawful basis, data subject rights, DPIAs, breach notification, international transfers, and Article 83 fine tiers.
GDPR Chapter V guide to adequacy decisions, SCCs, transfer assessments, supplementary measures, Article 49 derogations, and EU-US DPF checks.
Focused GDPR guide to Article 6 lawful bases, consent conditions, legitimate interests, special category data, withdrawal, and evidence records.
Assess GDPR legitimate interests with a purpose, necessity, balancing, Article 21 objection, and evidence-record workflow based on Article 6(1)(f).
How GDPR main establishment, cross-border processing, Article 56 lead authority competence, and Article 60 cooperation fit together.
This EU GDPR legitimate interests assessment template helps document Article 6(1)(f) purpose, necessity, balancing, safeguards, objection rights, and evidence.
EU GDPR penalties guide covering Article 83 fine ceilings, the EDPB calculation method, CJEU conditions, Article 58 powers, and evidence.
EU GDPR Article 28 guide for processor contracts, sub-processor controls, controller-processor role boundaries, vendor evidence, and SCC transfer clauses where applicable.
Build a GDPR Article 30 record of processing activities with separate controller and processor fields for purposes, data categories, recipients, transfers, erasure time limits, and security measures.
Overview of core EU GDPR requirements covering scope, principles, lawful basis, notices, data-subject rights, processors, RoPA, security, breaches, DPIAs, and international transfers.
Build an EU GDPR retention and erasure schedule with purpose-based periods, expiry actions, Article 17 decisions, recipient notices, and deletion evidence.
A GDPR workflow for checking adequacy, selecting SCC modules, documenting transfer impact assessments, and recording supplementary measures for third-country transfers.
GDPR privacy-notice guide for Articles 12, 13, and 14: direct collection, other data sources, purposes, lawful bases, recipients, transfers, retention, rights, and timing.
Compare EU GDPR and Brazil LGPD scope, actors, legal bases, rights timing, security incidents, international transfers, evidence, regulators, and penalties.
Compare EU GDPR and California CCPA scope, roles, consumer rights, response times, sale and sharing opt-outs, risk assessments, contracts, transfers, and enforcement.
Compare the EU GDPR and ePrivacy Directive for personal data processing, consent and lawful basis, cookies and terminal access, electronic communications, and parallel compliance.
Compare the EU GDPR and amended UK GDPR across scope, rights, automated decisions, accountability, breaches, regulators, and international transfers.
Map the GDPR work that remains necessary when an AI system processes personal data, including lawful basis, notices, DPIAs, Article 22, rights, security, records, and transfers.
Compare GDPR privacy duties with EU Data Act rights and duties for connected-product data, third-party access, data holders, users, contracts, cloud switching, and enforcement.
A GDPR Article 3 territorial-scope FAQ covering EU establishment, non-EU targeting, monitoring in the EU, public-international-law cases, and Article 27 representatives.
FAQ on the six Article 6 GDPR lawful bases, consent caveats, legitimate interests, public-task and legal-obligation limits, and Article 9 special-category data.
FAQ on when EU GDPR controllers may extend, charge for, narrow, redact, or refuse a data subject access request under Articles 12 and 15.
FAQ on when SCC transfer impact assessments are needed, what Clause 14 records, and when supplementary safeguards or transfer suspension are required.
Decide whether a party is a GDPR controller, processor, or joint controller using purpose-and-means tests, Article 28 terms, Article 26 arrangements, and Article 30 records.
Answer the EU GDPR DPIA threshold question with Article 35 triggers, high-risk criteria, supervisory-authority list checks, and DPIA content requirements.
GDPR breach-awareness FAQ covering the Article 33 clock, processor escalation, delayed or phased notifications, risk assessment, and records to keep.