This code is not in force and is subject to Parliamentary approval.

At a glance

Providers of ISS likely to be accessed by children should bring their processing in line with the standards in this code by [date of end of transition period].

In more detail

When will the code take effect?

This code was issued on [ ]. It comes into force on [ ]. Providers of relevant ISS likely to be accessed by children will then have 12 months from this date to make sure their services conform to the standards in the code.

From [end of transition period] the Commissioner must take the code into account when considering whether an online service has complied with its data protection obligations under the GDPR and PECR. The courts must also take the provision of the code into account, when relevant, from this date.

Our approach is to encourage conformance and we would encourage you to start preparing for the code taking effect sooner rather than later. In accordance with our Regulatory Action Policy, when considering any enforcement action we will take into account the efforts you have made towards conformance during the transition period, as well as the size and resources of your organisation, and the risks to children inherent in your data processing.

The code will apply to both new and existing services.

What should we do about our existing services?

We recommend that you start by reviewing your existing services to establish whether they are covered.

For services that are covered, you should already have a DPIA – but you should now review it (or conduct a new one) as soon as possible. This will give you the maximum amount of time available to you to bring your processing into line with the standards in the code. You should focus on assessing conformance with the standards in this code and identifying any additional measures necessary to conform.

You should make changes to your service as soon as possible, and in any event by [end of transition period]. 

Where changes include changes to physical rather than purely online products, then you should ensure that the necessary changes are incorporated into manufacturing cycles schedules commencing after [end of transition period]. For example, if you are making changes to packaging, printed information or the physical component of a connected toy or device. You will not be required to recall or amend existing stock, or to amend manufacturing cycles that were already scheduled to commence before [end of transition period] when this code came into force. 

You should also consider how to manage any changes to the way in which your service operates with your existing users. You should think about how their online experience might change and how best to communicate and prepare them for these changes so that any impact is properly managed.