http://www.legislation.gov.uk/ukpga/2018/12/section/123Data Protection Act 2018An Act to make provision for the regulation of the processing of information relating to individuals; to make provision in connection with the Information Commissioner's functions under certain regulations relating to information; to make provision for a direct marketing code of practice; and for connected purposes.texttext/xmlenStatute Law Database2026-09-29Expert Participation2026-06-19 PART 5The Information Commissioner<Emphasis>Codes of practice</Emphasis>Age-appropriate design code1231The Commissioner must prepare a code of practice which contains such guidance as the Commissioner considers appropriate on standards of age-appropriate design of relevant information society services which are likely to be accessed by children.2Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.3Before preparing a code or amendments under this section, the Commissioner must consult the Secretary of State and such other persons as the Commissioner considers appropriate, including—achildren,bparents,cpersons who appear to the Commissioner to represent the interests of children,dchild development experts, andetrade associations.4In preparing a code or amendments under this section, the Commissioner must have regard—ato the fact that children have different needs at different ages, andbto the United Kingdom's obligations under the United Nations Convention on the Rights of the Child.5A code under this section may include transitional provision or savings.6Any transitional provision included in the first code under this section must cease to have effect before the end of the period of 12 months beginning when the code comes into force.7In this section—“age-appropriate design” means the design of services so that they are appropriate for use by, and meet the development needs of, children;“information society services” has the same meaning as in the UK GDPR, but does not include preventive or counselling services;“relevant information society services” means information society services which involve the processing of personal data to which the UK GDPR applies;“standards of age-appropriate design of relevant information society services” means such standards of age-appropriate design of such services as appear to the Commissioner to be desirable having regard to the best interests of children;“trade association” includes a body representing controllers or processors;“the United Nations Convention on the Rights of the Child” means the Convention on the Rights of the Child adopted by the General Assembly of the United Nations on 20 November 1989 (including any Protocols to that Convention which are in force in relation to the United Kingdom), subject to any reservations, objections or interpretative declarations by the United Kingdom for the time being in force.Pts. 5-7 applied in part (with modifications) (5.2.2026) by S.I. 2003/2426, reg. 31, Sch. 1 (as substituted by Data (Use and Access) Act 2025 (c. 18), ss. 115(5)(8), 142(1), Sch. 13; S.I. 2026/82, reg. 2(y)(z14) (with regs. 8-11) and as amended (30.9.2026) by S.I. 2026/386, reg. 1(2), Sch. 3 para. 6(3), (4)(j); S.I. 2026/1015, reg. 2(c))S. 123 in force at 23.7.2018 by S.I. 2018/625, reg. 3(a)Words in s. 123(7) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 53 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)Pt. 5 applied in part (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 406 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g) (with reg. 4))