GDPR-K Article 35(1) and 35(3) - Data protection impact assessment (screening where processing reaches children)
Screen processing of children’s personal data for likely high risk and applicable supervisory-authority Article 35(4) lists. Carry out a DPIA before processing where required. Children’s vulnerability is a risk factor, not a universal rule that every processing operation requires a DPIA.
Where this comes from
Provision: Article 35(1) and 35(3) - Data protection impact assessment (screening where processing reaches children)
Instrument: General Data Protection Regulation (EU) 2016/679
Citation: Regulation (EU) 2016/679, OJ L 119, 4.5.2016, Article 35(1), 35(3)(a)-(c), 35(7) and 35(11); Article 36(1); read with Recital 75; WP248 rev.01 (adopted 4 April 2017, last revised 4 October 2017, endorsed by the EDPB 25 May 2018), the vulnerable-data-subjects criterion
Text version: Regulation (EU) 2016/679 (GDPR), OJ L 119, 4.5.2016, as adopted (CELEX 32016R0679), read from the Publications Office Cellar manifestation on 2026-09-21 because EUR-Lex served an empty body to non-browser clients; the 2018 corrigendum (OJ L 127, 23.5.2018) was not retrievable, so any correction it made is unverified.
Who it applies to
It applies when all of these are true:
- Service is likely to be accessed by children under 18
- Service processes personal data
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Screen processing of children’s personal data for likely high risk and applicable supervisory-authority Article 35(4) lists. Carry out a DPIA before processing where required. Children’s vulnerability is a risk factor, not a universal rule that every processing operation requires a DPIA. A DPIA is in particular required in the Article 35(3) cases, of which (a) - a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based - is the one most likely to apply to a children's service; review it at least when the risk changes (Article 35(11)) and consult the supervisory authority before processing where a high residual risk remains (Article 36(1)).
- Document the screening rationale, national mandatory lists and the Article 35(7) assessment where required. Seek DPO advice where designated; review when risk changes and assess Article 36 consultation for residual high risk. The trigger selects screening, not a legal conclusion.
- Record the assessed scope, evidence and unresolved questions; completing this task is not a legal compliance determination.
Evidence an auditor expects
- Assessment documentDocument review
Source-scoped applicability and implementation assessment
Assess the corrected source record, its conditions and exceptions before choosing implementation evidence. Preserve unresolved legal questions; evidence is not a declaration of full compliance.
Questions people ask
- Does GDPR-K Article 35(1) and 35(3) - Data protection impact assessment (screening… apply to my service?
- It applies when Service is likely to be accessed by children under 18; Service processes personal data.
- From when does this apply?
- GDPR-K Article 35(1) and 35(3) - Data protection impact assessment (screening… applies from 25 May 2018. Its current status is: in force.
- What evidence does an auditor expect?
- Source-scoped applicability and implementation assessment.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.