UK Online Safety Act ICO Overlap

Age assurance, content moderation, recommender controls, profiling, identity signals, user reports, and child-safety analytics can process personal data while also serving an Online Safety Act duty. The service must meet the applicable safety outcome and comply with UK GDPR principles, lawful-basis rules, transparency, rights, security, accountability, and retention requirements.

The Children's Code applies to relevant information-society services likely to be accessed by children and explains how UK data-protection law applies in that context. Its scope test and the Online Safety Act children's access assessment come from different legislation. Record both conclusions rather than treating one as a substitute for the other.

Start with the exact legal outcomes rather than assuming one regulator requires maximum data collection. Define the safety risk, the required effectiveness level, and the minimum personal data needed to achieve it. Compare feasible methods, including their accuracy, bias, circumvention, security, retention, and effects on rights.

For age assurance, Ofcom and the ICO say all methods process personal data, self-declaration alone is ineffective, and data may be processed where the method is necessary, proportionate to the risk, and compliant with data-protection law. The joint statement does not create an exemption from either regime.

Keep separate but linked records: the service-scope decision, risk assessments, code or guidance mapping, data protection impact assessment, lawful-basis analysis, privacy notices, legitimate-interests assessment where relevant, vendor terms, security review, retention schedule, test results, complaints, and change approvals.

Record how errors affect people. False adult classifications can expose children to harm; false child classifications can deny adults access or subject them to different processing. Test affected groups, monitor outcomes, and review both the safety and privacy records after material changes or incidents.