ICO Updates Guidance On Using Children's Information

On 15 May 2026, the UK Information Commissioner's Office (the ICO) updated both its brief guidance on using children's personal data (the Brief Guidance) and its detailed Children and the UK GDPR guidance (the Detailed Guidance) (together, the Guidance). The updates to the Guidance were not subject to a consultation process, presumably as the provisions clarify and reinforce existing UK GDPR requirements rather than addressing major new steps required of organisations. 

The Guidance reflects changes introduced by the Data (Use and Access) Act 2025 (DUAA) that are likely to impact an organisation’s use of children’s data. For example, the Guidance addresses the requirement that a controller must take account of children’s higher protection matters (the Higher Protection Matters) when processing data in the course of providing information society services (ISS) likely to be accessed by children (the Higher Protection Matters Duty). The three children’s Higher Protection Matters are: