In more detail
What do we need to do if we want to share children’s personal data with third parties?
If you want to share children’s personal data with third parties then you need to follow the approach set out in our Data Sharing Code of Practice. Although this has been issued under the Data Protection Act 1998 its basic approach remains valid under the UK GDPR. In time this guidance will be updated to reflect the specific provisions of the UK GDPR and the Data Protection Act 2018.
We would also recommend that you carry out a DPIA to assess the risks inherent in the data sharing. If the processing falls within one of the categories the Commissioner considers to be likely to result in a high risk to the rights and freedoms of children then a DPIA is compulsory. For further guidance on DPIAs please see our Guide to the UK GDPR.