What evidence do auditors commonly ask for on Art.8 Conditions applicable to child's consent?

The assessment of whether the service is an information society service offered directly to children; The age threshold applied per Member State, with evidence the applicable national lower age was checked rather than assumed; The age assurance mechanism, and the reasoning for why it is a reasonable effort given available technology; Parental authorisation records where the user is below the threshold, including the verification carried out on the parent; The procedure and records for what happens when a user is identified as under age after registration.

What is the most common gap auditors find on Art.8?

A self declared date of birth with no verification at all treated as reasonable effort

GDPR · Chapter II - Principles

`Art.8` Conditions applicable to child's consent

Where consent is the lawful basis and information society services are offered directly to a child, processing the child's personal data on the child's own consent is lawful only from age 16, or from the lower age a Member State has set in law, which may be no lower than 13. Below that age the processing is lawful only to the extent consent is given or authorised by the holder of parental responsibility, and the controller must make reasonable efforts to verify that it was, taking available technology into consideration.

Source: GDPR, Art.8. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open GDPR in the compliance library.

Many articles apply only where their condition is met (a data protection officer under Article 37, an impact assessment under Article 35, a representative under Article 27); the condition is in each statement.

artefacts

held by a system

at each review

hard

to go live

Document repository

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

none for this control

periodic reviewEvidence produced at each review

The assessment of whether the service is an information society service offered directly to children · Document repository
Parental authorisation records where the user is below the threshold, including the verification carried out on the parent · Document repository
The procedure and records for what happens when a user is identified as under age after registration · Policy repository / GRC workspace

governing documentDocuments that govern the control

The age threshold applied per Member State, with evidence the applicable national lower age was checked rather than assumed · Document repository
The age assurance mechanism, and the reasoning for why it is a reasonable effort given available technology · Document repository

First move

No system holds this evidence for you: it is people and documents. Reminders and routing to the owner still save time. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date.

Common gaps auditors find

A self declared date of birth with no verification at all treated as reasonable effort
A single threshold of 16 applied across the Union without checking the Member States that set 13, 14 or 15
Parental consent captured from an email address that is never verified as belonging to a parent
The service judged not child directed on the basis of its terms of use rather than its actual audience

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

Art.7 Conditions for consent · Art.9 Processing of special categories of personal data