Data Protection Act 2025, children and individuals lacking capacity

Data Protection Act 2025, s. 12 (consent for children and individuals lacking capacity)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Commencement not set.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

This Act is enacted but not in force: section 2 leaves commencement to a ministerial notice, and none was located as of this review, so the consent rule for children and individuals lacking capacity does not bind anyone yet.
On commencement, obtain consent from a parent, guardian, or other appropriate legal representative before relying on the consent of a data subject who is under eighteen or otherwise lacks legal capacity, wherever the Act requires the data subject's consent for a lawful basis, retention, an automated decision, or a cross-border transfer.
On commencement, obtain that same consent from a parent, guardian, or other appropriate legal representative before relying on a data subject's voluntary provision of personal data as a lawful basis, where the data subject is under eighteen or otherwise lacks legal capacity.
On commencement, let a parent, guardian, or other appropriate legal representative exercise a data subject's rights or lodge a complaint on behalf of a data subject who is under eighteen or otherwise lacks legal capacity.
On commencement, treat the parental or guardian consent requirement as not applying to processing carried out for education, medical, or social care by a professional owing a duty of confidentiality, to processing necessary for court proceedings concerning the individual, or to a child of thirteen or older requesting an online service directly.

What it reaches

Obligation class

Consent, Age verification

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 12(1) requires that wherever the Act would otherwise rely on a data subject's consent, including the retention consent under section 10(e)(iii), the automated-decision consent under section 17(c), the lawful-basis consent under section 11(2)(a), or the cross-border-transfer consent under section 24(a), that consent be obtained instead from a parent, legal guardian, or other appropriate legal representative where the data subject is under eighteen or otherwise lacks legal capacity.

Section 12(1)(b) applies the same substitution to the voluntary provision of personal data that section 11(2)(b) or section 24(b) treats as a lawful basis. Section 12(1)(c) requires a parent, guardian, or other appropriate legal representative to exercise a data subject's Part IV rights or lodge a complaint under section 26 on that data subject's behalf.

Section 12(2) disapplies the parental consent requirement for processing carried out for education, medical, or social care by a professional owing a duty of confidentiality, or necessary for court proceedings concerning the individual. Section 12(2)(c) also disapplies it where the processing concerns a child of thirteen years or older requesting information or a service by electronic means at the child's own specific request.

The Act defines no separate category of sensitive personal data, so section 12's heightened consent rule for children and individuals lacking capacity is the only special-category protection this Act states.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
serves_minors

Read the law

Act text as published by the Ministry of Information, Communications and Transport (Data Protection Act 2025).

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app