UK AADC Standard 2 — Data protection impact assessments (ICO Age Appropriate Design Code, statutory guidance under DPA 2018 s…
Conduct DPIAs for services likely accessed by children, accounting for age differences
Where this comes from
Provision: Standard 2 — Data protection impact assessments (ICO Age Appropriate Design Code, statutory guidance under DPA 2018 s 123)
Instrument: UK Age Appropriate Design Code
Citation: Data Protection Act 2018 s 123/s 127; ICO Age Appropriate Design Code, Standard 2 — Data protection impact assessments; the DPIA obligation itself derives from UK GDPR Art 35 (not independently re-verified against the GDPR text in this unit)
Text version: ICO Age Appropriate Design Code (statutory code of practice under Data Protection Act 2018 s 123; in force from 2 September 2020 with a transition period to 2 September 2021 - date not independently verified on the ICO pages), fifteen standards as displayed on ico.org.uk on 2026-09-23. The Data (Use and Access) Act 2025 has amended UK GDPR and the ICO has signalled a revised code: check for a reissued code before relying on this text.
Who it applies to
It applies when all of these are true:
- Service is likely to be accessed by children under 18
Scope in the source's own terms
- Service is likely to be accessed by children (under 18)
- Service is offered to users in the United Kingdom
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Assessment covers data flows, the risks to the affected group, and likelihood/severity
- Each identified risk has a mitigation mapped to a concrete control or backlog item
- The assessment is dated, has named sign-off, and is scheduled for review
- The assessment is retrievable for regulators on request
- Signed assessment document is stored and version-controlled
Evidence an auditor expects
- User-interface evidenceUser testing
Screenshots of default privacy settings for new child accounts
UI evidence showing all privacy settings default to most protective options for users under 18
- Technical controlTechnical audit
Default configuration in codebase
Code showing default values for privacy settings differentiated by user age
- Policy documentDocument reviewRecommended
Privacy defaults rationale document
Document explaining each privacy setting default and why it serves best interests of children
Questions people ask
- Does UK AADC Standard 2 — Data protection impact assessments (ICO Age Appropriate… apply to my service?
- It applies when Service is likely to be accessed by children under 18.
- From when does this apply?
- UK AADC Standard 2 — Data protection impact assessments (ICO Age Appropriate… applies from 2 September 2021. Its current status is: in force.
- What evidence does an auditor expect?
- Screenshots of default privacy settings for new child accounts; Default configuration in codebase; Privacy defaults rationale document.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.