GDPRRequests from parents about their children's data

Before responding to a request like this, consider whether the child is mature enough to understand their data protection rights and the implications of making a request.

Children over the age of 12 are usually considered old enough, but it should be a case-by-case decision. If you think they are mature enough, you should usually respond directly to the child, but you may respond to the parent if the child authorises it or if it's evident that this is in the best interests of the child.

If you don't think the child is mature enough, respond to their parents, as they can exercise these access rights on their child's behalf.

If you're unsure who to respond to, weigh up: 

  • How mature the child is
  • The nature of personal data requested
  • If there are any court orders relating to parental access or responsibility that apply
  • Any confidentiality owed to the child regarding this data
  • The likely consequences if you give the data to the parents - particularly if there have been any allegations of abuse or ill treatment against the parents 
  • If the child would suffer any detriment if their parents cannot access the information
  • If the child has any views on whether their parents should have access to information about them

Information taken from 'The Key for School Leaders' website.