Information Commissioner's Office Publishes Blog Post On Data Protection Impact Assessments In Relation To The Children's Code

• Published date: 14 June 2021
• Subject Matter: Privacy, Data Protection, Privacy Protection
• Law Firm: Wiggin
• Author: Mr Patrick O'Connell

The ICO has launched a new blog series to support organisations to comply with the Children's Code. Organisations have until 1 September 2021 to comply.

The first blog post covers data protection impact assessments, reminding all organisations in the scope of the Children's Code that they are obligated to complete a DPIA. Undertaking a DPIA is one of the standards set out in the Children's Code and is also a key part of organisations' accountability obligations under the UK GDPR.

The ICO explains that a DPIA is "a process to help you assess and mitigate the data protection risks of your service to the rights of children who are likely to access it". In the context of the Code, it is the vehicle through which to assess whether an organisation's services are designed to support the best interests of children.

The ICO says that a DPIA will help identify and document the questions that need to be answered in order to conform with the Children's Code. It will also help identify risks and design appropriate changes to mitigate them and conform with the Code, i.e. privacy by design. The ICO says that it can also bring cost savings and broader benefits for both children and the organisation. It reassures parents and builds trust.

When undertaking a DPIA, organisations need to follow the usual DPIA process set out in the ICO's separate guidance on how to conduct a DPIA, as well the Children's Code DPIA standard. The blog post also...