FieldRegister
Every field · Demographics

Child or dependant details

Data about children needs parental consent for online services and a child-appropriate notice.

personal data
personal data?
confidential
sensitivity
never
AI use
parental consent (Art. 8)
lawful basis usually relied on

Keep it how long

Only for the specific purpose.

The gap we see most

Dependant names collected for an event and kept on the parent record.

What holding it is evidence for

Requirement text and artefacts stated in our own words from the published standards.

Data about children GDPR Art.8 · CCPA/CPRA §1798.120(c) · ISO/IEC 27701:2019 7.2.3
GDPR Art.8 Conditions applicable to child's consent

Where consent is the lawful basis and information society services are offered directly to a child, processing the child's personal data on the child's own consent is lawful only from age 16, or from the lower age a Member State has set in law, which may be no lower than 13. Below that age the proce...

Evidence an auditor accepts: The assessment of whether the service is an information society service offered directly to children; The age threshold applied per Member State, with evidence the applicable national lower age was checked rather than assumed; The age assurance mechanism, and the reasoning for why it is a reasonable effort given available technology
CCPA/CPRA §1798.120(c) Obtain opt-in before selling or sharing data of consumers under 16

A business may not sell or share data about a consumer it knows (or wilfully ignores) is under 16 unless the consumer, if 13 to 15, or a parent or guardian, if under 13, has affirmatively authorised it. Under 11 CCR 7070 and 7071 the business must document a reasonable parental-consent method for un...

Evidence an auditor accepts: Age-determination approach and the signals treated as actual knowledge of age; Parental consent mechanism records for under-13 users; Opt-in records for users aged 13 to 15
ISO/IEC 27701:2019 7.2.3 Determine when and how consent is to be obtained

The organization must determine and document a process by which it can demonstrate whether, when and how consent to processing was obtained, clearly documenting when consent is needed and what obtaining it requires, correlating purposes with how consent is obtained, and taking into account jurisdict...

Evidence an auditor accepts: Documented consent process covering when consent is required and what valid consent demands; Mapping from each purpose to whether and how consent is obtained; Analysis of jurisdiction specific consent requirements and how the mechanism meets them

Do this for your whole CRM

Paste your field list and get this classification for every field at once, with the record of processing per object, the gaps, and the controls the register is evidence for. No account for the first run.

Build my field register

Password, PIN or security answer · Date of birth or age