Who can access a child’s personal data?

Children have the same rights as adults in relation to their personal data, including the right to request access to it, commonly referred to as a subject access request.

Any child may exercise their access rights as long as they are considered competent to do so. In England, ‘competence’ is assessed on the level of the child’s understanding, and they should not be deemed competent if it is evident that they are acting against their own best interests.

Can parents or guardians make a subject access request on behalf of their child?

Regardless of their age, the right belongs to the child and not their parent or guardian, who should only be allowed to exercise a child’s right of access on behalf of them if:

• the child authorises them to do so;
• the child does not have sufficient understanding to exercise the rights themselves; or
• it is evident that it is in the best interest of the child.

When assessing whether a child is capable of authorising a subject access request, you need to establish whether the child can understand and deal with the implications of exercising their data protection rights. For example, do they understand what it means to request a copy of their personal data and how to interpret the information that they receive as a result of doing so?

Should you allow the parents or guardians to access their child’s data?

When considering a subject access request from a child’s parent or guardian, it is important to consider the following factors before releasing the information:

• the nature of the personal data;
• any court orders relating to parental access or responsibility that may apply;
• any duty of confidence owed by you to the child or young person;
• any consequences of allowing those with parental responsibility access to exercise the child’s rights, which is particularly important if there have been allegations of abuse or ill-treatment;
• any detriment to the child or young person if individuals with parental responsibility cannot access this information; and
• any views the child or young person has on whether their parents or guardians should have access to information about them.

If you are satisfied that the child is incapable of making the subject access request themself and that obtaining the information is in the best interest of the child, then it is usually appropriate to allow the parent or guardian to exercise the child’s rights on their behalf.

However, if you have evidence that providing the data is not in the best interest of the child, for example, because there are safeguarding issues, you have the right to decline the parent or guardian’s request.