# GDPR Article 8 — Conditions applicable to child's consent in relation to information society services - Source: https://support.icompaas.com/compliance/gdpr/article-8-conditions-applicable-to-child-s-consent-in-relation-to-information-society - Section: [Compliance](https://support.icompaas.com/compliance) › [GDPR (Regulation (EU) 2016/679)](https://support.icompaas.com/compliance/gdpr) › Articles 1–10 - Last updated: 2026-06-05 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **GDPR**·Article `Article 8`·medium·Component: **Chapter II: Principles** ## What this control requires > Ensures lawful processing of a child's personal data for information society services, requiring parental consent for children under 16, with verification efforts. This control addresses Application (UI). > > — GDPR, Article Article 8 ### In plain English Ensures lawful processing of a child's personal data for information society services, requiring parental consent for children under 16, with verification efforts. In practice, this means you can prove you principles consent-level controls on a defined cadence. ## Why it matters GDPR administrative fines reach the greater of €20 million or 4% of global annual turnover. The European Data Protection Board (EDPB) coordinates supervisory-authority enforcement across the EU/EEA, and DPAs publish enforcement decisions citing specific Articles. ## What an auditor looks for A DPA or privacy auditor expects: a Records of Processing Activities (RoPA) entry, a documented lawful basis, evidence the Article's data-subject right is operationalised end-to-end, a named DPO contact (where required), and Article 30 records that match what the front-end actually does. Within **Chapter II: Principles**, the assessor will trace your implementation back to the catalogue reference (Article Article 8) and look for objective evidence on the latest two assessment cycles. ## How to implement #### Policy Management **Docs.** Keep each policy in version-controlled Markdown alongside the code that implements it; ship a signed PDF snapshot at each annual review and link the SHA into the SoA. ### Operational checklist - **Principles.** Document the trigger, the owner and the cadence. - **Conditions.** Document the trigger, the owner and the cadence. - **Information.** Document the trigger, the owner and the cadence. - **Data.** Document the trigger, the owner and the cadence. - **Scope:** consent, information. ## Evidence to collect - **Policy Document.** A signed and version-controlled policy / standard / procedure document. - **Infra Scan.** Continuous infrastructure-posture telemetry — AWS Config, Azure Policy compliance, GCP Organisation Policy, Wiz / Prisma findings. Signed policy or standard documents the safeguard. Focus: Conditions applicable to child's consent in relation to information society services. ## Common pitfalls - Policies that no engineer has read; the version in Confluence drifts from the version that's actually being enforced. ## How it maps to other frameworks Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit. - [**India DPDP Act 2023 DS-005** — Consent Withdrawal Mechanism](https://support.icompaas.com/compliance/india-dpdp-act-2023/ds-005-consent-withdrawal-mechanism) - [**ISO/IEC 27701:2025 A.1.2.5** — Obtain & record consent](https://support.icompaas.com/compliance/iso-27701-2025/a-1-2-5-obtain-record-consent) - [**ISO/IEC 27001:2022 A.5.13** — Labelling of information](https://support.icompaas.com/compliance/iso-27001-2022/a-5-13-labelling-of-information) - [**SOC 2 (2017 TSC) P3.2** — Consent Management for Personal Information Collection](https://support.icompaas.com/compliance/soc-2-trust-services-criteria/p3-2-consent-management-for-personal-information-collection) - [**NIST SP 800-53 Rev. 5 PT-4** — Consent](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5/pt-4-consent) ## Related controls in GDPR - [**Article Article 6** — Lawfulness of processing](https://support.icompaas.com/compliance/gdpr/article-6-lawfulness-of-processing) - [**Article Article 7** — Conditions for consent](https://support.icompaas.com/compliance/gdpr/article-7-conditions-for-consent) - [**Article Article 9** — Processing of special categories of personal data](https://support.icompaas.com/compliance/gdpr/article-9-processing-of-special-categories-of-personal-data) - [**Article Article 11** — Processing which does not require identification](https://support.icompaas.com/compliance/gdpr/article-11-processing-which-does-not-require-identification) - [**Article Article 4** — Definitions](https://support.icompaas.com/compliance/gdpr/article-4-definitions) - [**Article Article 10** — Processing of personal data relating to criminal convictions and offences](https://support.icompaas.com/compliance/gdpr/article-10-processing-of-personal-data-relating-to-criminal-convictions-and-offences) ## References - [European Union — GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) - Catalogue identifier: `Article Article 8` Topics: governance riskpolicy managementprivacy management ## Related compliance guidance - [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): Start with the full GDPR implementation guide — scope, roadmap, evidence and how the assessment runs. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): The security management system most EU procurement teams ask for alongside a DPA; its controls supply much of the Article 32 evidence. - [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): If engineering or support teams sit in India, the same data flows are also subject to India’s Digital Personal Data Protection Act.