Can we share children’s personal information?

In more detail

What do we need to do if we want to share children’s personal information with third parties?

You must take extra care when sharing children’s personal information with third parties. This is because sharing their information can expose them to unintended risks if not done properly.

If you want to share children’s personal information, you must have a compelling reason to do so, taking into account the best interests of the child. 

Clear examples of compelling reasons to share children’s personal information include: 

• for safeguarding purposes; 
• to provide good-quality information about children for official national statistics; and
• to prevent or detect crimes against children (eg online grooming).

However, selling on children’s personal information for commercial re-use is unlikely to count as a compelling reason for data sharing. This is particularly the case where it increases the risk of onward disclosure or use beyond the child’s reasonable expectations.

Considering children’s best interests will help you comply with the lawfulness, fairness and transparency requirements under the UK GDPR.

You should complete a DPIA to assess and mitigate the risks to children that your data sharing might cause. If your use of children’s personal information falls into one of the categories we think are likely to result in a high risk to their rights and freedoms, you must complete a DPIA.