Rule 12 exemptions for children's data

What Rule 12 lifts, and what it does not

Rule 12 sets out the exemptions that s.9(4) and s.9(5) allow to be prescribed. It starts on 13 May 2027 (Rule 1).

Outside an exemption, the default applies: verifiable consent of a parent under Rule 10, and no tracking, behavioural monitoring or targeted advertising directed at children (s.9(3)). The exemptions are reliefs, not duties. If you can meet s.9(1) and s.9(3) anyway, you may not need Rule 12 at all.

Part A: classes of Data Fiduciaries

Part A of the Fourth Schedule lists classes of Data Fiduciaries. Examples include:

• clinical establishments;
• allied healthcare;
• educational institutions;
• crèches and child-care centres;
• transport for school children.

Each class is exempt only for the processing, and within the conditions, that the Schedule states.

Part B: purposes

Part B lists purposes. Examples include:

• age verification;
• email-only accounts;
• real-time location for safety.

Part B is framed around purposes rather than types of organisation, so the question is what the processing is for. Again, the exemption covers only that purpose, within its conditions.

Reading Rule 12 narrowly

• An exemption covers a class or a purpose, not a whole business. Processing outside it needs the full s.9 duties.
• Do not assume you fit a Part A class because your users are children or your customers are schools. Check the wording; edtech teams should take particular care.
• Section 9(2) always applies: no processing likely to harm a child's well-being.
• Duties outside s.9, such as security safeguards (s.8(5)) and breach intimation (s.8(6)), are not lifted by Rule 12.
• Write down your reasoning. If asked, you will need to show why the exemption applied.

Document each reliance

1. 01Name the class or purpose

   Record the Part A class or Part B purpose you rely on.

2. 02Quote the condition

   Copy the condition from the Fourth Schedule into your record.

3. 03Show you stay within it

   Describe the processing and why it stays inside the condition.

4. 04Limit the data

   Collect only what the exempt purpose needs.

5. 05Review

   Check again when the product, purpose or data changes, and have counsel sign off.

Questions to answer before relying on an exemption

• Which Part A class or Part B purpose do we fall within, in the Schedule's own words?
• What condition does the Schedule attach, and how do we meet it?
• Is every data field we collect needed for that purpose?
• Does any part of our processing fall outside the exemption, so that s.9(1) or s.9(3) still applies?
• How do we make sure the processing is not likely to harm a child's well-being (s.9(2))?
• Who reviewed this, and when will we review it again?

How TruePrivacy helps

Records of processing in TruePrivacy give you one register of processing activities in which to describe each exempt activity, and DPIAs and PIAs from templates help you assess them. Where no exemption applies, the guardian consent flow in children's data records the parent's decision with a timeline and evidence.

Retention rules can act on data collected under an exemption once its keep-for period ends. Sector context is in edtech, and the verifiable consent guide covers the default s.9(1) route.