How the ICO and Online Safety Act overlap in practice
The overlap means a service can have to follow both online safety and data protection rules at the same time. Ofcom and the ICO say online services should design safety measures with privacy in mind, and the ICO says services likely to be accessed by children may also need to follow the Children's code.
Teams should treat Ico Overlap under the UK Online Safety Act as a source-linked operating decision: confirm whether the service is in scope and which illegal-content, children-safety, age-assurance, user-empowerment, transparency, complaints, risk-assessment, or Ofcom enforcement duty is triggered, assign the team that can change the process, and keep evidence showing the action and review trigger.
The safest first step is to classify the service, user-to-user/search functionality, child-access status, illegal-content risk, and Ofcom code mapping before assigning the Online Safety Act action.
- Write the Ico Overlap decision in one sentence before drafting controls.
- Attach the external source URL and a short source quote to the evidence record.
- Route unclear cases to legal, privacy, security, or compliance review before launch.
ICO legislative-framework guidance supports the overlap answer by connecting age assurance, the Children's code, UK GDPR, the DPA 2018, and online safety duties.
Direct support for the FAQ answer on Ico Overlap.
Direct support for the FAQ answer on Ico Overlap.