FieldRegister
Every field · Demographics

Child or dependant details

Data about children needs parental consent for online services and a child-appropriate notice.

personal data
personal data?
confidential
sensitivity
never
AI use
parental consent (Art. 8)
lawful basis usually relied on

Keep it how long

Only for the specific purpose.

The gap we see most

Dependant names collected for an event and kept on the parent record.

What holding it is evidence for

Requirement text and artefacts from a human-verified corpus licensed to Field Register.

Data about children GDPR Art.8 · CCPA/CPRA §1798.120 · ISO/IEC 27701:2019 7.2.3
GDPR Art.8 Conditions applicable to child's consent

Where consent is the lawful basis and information society services are offered directly to a child, processing the child's personal data on the child's own consent is lawful only from age 16, or from the lower age a Member State has set in law, which may be no lower than 13. Below that age the proce...

Evidence an auditor accepts: The assessment of whether the service is an information society service offered directly to children; The age threshold applied per Member State, with evidence the applicable national lower age was checked rather than assumed; The age assurance mechanism, and the reasoning for why it is a reasonable effort given available technology
CCPA/CPRA §1798.120 Right to Opt Out of Sale or Sharing of Personal Information

Consumers have the right, at any time, to direct a business that sells or shares PI about the consumer to third parties to stop selling or sharing the consumer's PI. Businesses that sell or share PI of consumers under 16 must obtain opt-in consent (parent/guardian if under 13). Once a consumer opts ...

Evidence an auditor accepts: Do Not Sell or Share My Personal Information mechanism; Age verification and opt-in records for minors; 12-month re-solicitation cooldown tracking
ISO/IEC 27701:2019 7.2.3 Determine when and how consent is to be obtained

The organization must determine and document a process by which it can demonstrate whether, when and how consent to processing was obtained, clearly documenting when consent is needed and what obtaining it requires, correlating purposes with how consent is obtained, and taking into account jurisdict...

Evidence an auditor accepts: Documented consent process covering when consent is required and what valid consent demands; Mapping from each purpose to whether and how consent is obtained; Analysis of jurisdiction specific consent requirements and how the mechanism meets them

Do this for your whole CRM

Paste your field list and get this classification for every field at once, with the record of processing per object, the gaps, and the controls the register is evidence for. No account for the first run.

Build my field register

Password, PIN or security answer · Date of birth or age