My child's school shares their data with third parties. Is parental consent required?

What the Law Says

The General Data Protection Regulation (GDPR) governs how schools in the EU process children’s personal data — including sharing it with third parties. Special protections apply to children, and consent requirements differ depending on the child’s age.

Under GDPR Article 6, any processing of personal data — including sharing with third parties — must have a lawful basis. Consent is one such basis, but others include necessity for a contract, legal obligation, or legitimate interest. However, when targeting children, consent is often the most appropriate and safest basis — especially for non-essential sharing.

GDPR Article 8 specifically addresses children’s consent for information society services. It states that, for children under the age of 16, consent must be given or authorised by the holder of parental responsibility. Member States may lower this age to a minimum of 13 — but no EU country sets it above 16.

Schools are considered data controllers and must ensure transparency: they must clearly inform parents and children about who receives the data, why, and how long it will be kept — typically via a privacy notice.

Statutory Text

Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.

— Regulation (EU) 2016/679, Art. 8(1) — Conditions applicable to child’s consent in relation to information society services

Statutory Text

Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes...

— Regulation (EU) 2016/679, Art. 6(1)(a) — Lawfulness of processing

Sources