Data Protection Act, 2019 — processing of personal data relating to a child

s. 33 sets two cumulative conditions, and businesses routinely satisfy only the first: a controller or processor may not process a child's personal data unless consent is given by the child's parent or guardian AND the processing is carried out in a manner that protects and advances the rights and best interests of the child. That second limb is a substantive standard, not a formality — parental consent alone does not make an otherwise child-hostile processing purpose lawful. A child is anyone under 18. s. 33(2) requires appropriate age-verification mechanisms without defining them, a gap the ODPC has since addressed in its 2025 Guidance Note for Processing Children's Data, which is the document to read alongside the section. The ODPC has issued rulings on commercial use of minors' data and image rights, so this is actively enforced rather than dormant.