Transitional arrangements
At a glance
Providers of ISS likely to be accessed by children should bring their processing in line with the standards in this code by 2 September 2021.
In more detail
When will the code take effect?
The code was issued on 12 August 2020.
It comes into force on 2 September 2020.
From 2 September 2021 the Commissioner must take the code into account when considering whether an online service has complied with its data protection obligations under the GDPR and PECR. The courts must also take the provision of the code into account, when relevant, from this date.
Our approach is to encourage conformance and we would encourage you to start preparing for the code taking effect sooner rather than later. In accordance with our Regulatory Action Policy, when considering any enforcement action we will take into account the efforts you have made towards conformance during the transition period, as well as the size and resources of your organisation, and the risks to children inherent in your data processing.
The code will apply to both new and existing services.
What should we do about our existing services?
We recommend that you start by reviewing your existing services to establish whether they are covered.
For services that are covered, you should already have a DPIA – but you should now review it (or conduct a new one) as soon as possible. This will give you the maximum amount of time available to you to bring your processing into line with the standards in the code. You should focus on assessing conformance with the standards in this code and identifying any additional measures necessary to conform.
You should make changes to your service as soon as possible, and in any event by 2 September 2021.
Where changes include changes to physical rather than purely online products, then you should ensure that the necessary changes are incorporated into manufacturing cycles schedules commencing after 2 September 2021. For example, if you are making changes to packaging, printed information or the physical component of a connected toy or device. You will not be required to recall or amend existing stock, or to amend manufacturing cycles that were already scheduled to commence before 2 September 2021 when this code came into force.
You should also consider how to manage any changes to the way in which your service operates with your existing users. You should think about how their online experience might change and how best to communicate and prepare them for these changes so that any impact is properly managed.