⌘CodeQuest
Data, Privacy & Compliance

Lesson 5 of 6

Lesson 5 — Children's Data, Special Categories and Sending Data Abroad

Extra rules for the riskiest data — and what happens when your servers are in another country.

🔴 Advanced 95 XP

Learn it

Children's data gets extra protection: clearer language, stronger defaults, and parental consent below a certain age (13-16 depending on the country).

Special category data needs a second condition on top of a lawful basis — usually explicit consent.

Sending personal data outside the UK/EU needs a transfer mechanism such as an adequacy decision or Standard Contractual Clauses.

Key terms

Explicit consent
A clear, affirmative statement covering specific sensitive processing.
Adequacy decision
An official ruling that a country's protection is equivalent.
SCCs
Standard Contractual Clauses — approved contract terms enabling transfers.
Data residency
A requirement that data physically stays in a given region.
Profiling
Automated evaluation of personal aspects to predict behaviour.

Design a teen app the compliant way

A study app for 13-16 year-olds.

  1. 1Defaults: Profile private, location off, no behavioural ads, no public leaderboards by real name.
  2. 2Language: Privacy notice written for a 13-year-old, not a lawyer.
  3. 3Age assurance: Proportionate age checks; parental consent below the national age threshold.
  4. 4Region: Store data in an EU region so no transfer mechanism is needed.

Documenting a transfer decision

yamltransfer:
  data: "student names, emails, progress scores"
  from: "EU (Ireland)"
  to: "US vendor - analytics"
  mechanism: "Standard Contractual Clauses (2021) + transfer risk assessment"
  supplementary_measures:
    - "pseudonymise student IDs before export"
    - "encryption in transit and at rest, keys held in EU"
    - "no special category data in the export"
  reviewed: "2026-01-15"

Auditors want the reasoning written down, not just the contract signed.

Try it

A UK school wants to use a US homework tool that stores data in Virginia. What is required?

textData: pupil names, emails, homework grades
Destination: United States (no adequacy for this vendor path)
Vendor role: processor

Challenge

Your ed-tech startup wants to add AI marking that sends student essays to a US model provider. Write the compliance case: lawful basis, children's protections, transfer mechanism, and what you would change in the design to reduce risk.

Pick whichever way suits you — every mode earns the same bonus XP.

Write at least 40 more characters to submit.

Mark your own work

Guided walkthrough — 0/3 clues revealed

  1. Clue 1 locked — reveal it only if you get stuck.
  2. Clue 2 locked — reveal it only if you get stuck.
  3. Clue 3 locked — reveal it only if you get stuck.

Each clue costs 5 XP (never below 24 XP). You'd earn 48 XP right now.

Quiz time

Question 1 of 4Score 0

Special category data needs…