What should teams do about Children's Code under the UK GDPR?
Teams should treat Children's Code under the UK GDPR as a source-linked operating decision for online services likely to be accessed by children: confirm whether the issue affects controller/processor roles, lawful basis, transparency, DPIA, data-subject rights, breach notification, IDTA/Addendum transfers, children data, or ICO enforcement exposure, assign the team that can change the process, and keep evidence showing the action and review trigger.
The safest first step is to confirm whether the product or service is likely to be accessed by children, then identify the controller/processor role, purpose, lawful basis, special-category status, right, breach, transfer, or child-data trigger before assigning the UK GDPR action.
- Write the Children's Code decision in one sentence before drafting controls.
- Attach the external source URL and a short source quote to the evidence record.
- Route unclear cases to legal, privacy, security, or compliance review before launch.
ICO statutory Children's Code source supporting age-appropriate design duties for online services likely to be accessed by children.
ICO design guidance showing when teams should consider the Children's Code standards and children's best interests during product design.
GOV.UK publication record confirming the Age Appropriate Design Code was laid before Parliament.