In this guide · 8 sections
- 01What the PDPC advisory covers and who it applies to
- 02Consent: under 13, 13 to 17, and when to ask parents anyway
- 03Writing notices and forms children can understand
- 04Data minimisation, profiles and location
- 05Security and data breaches involving children
- 06A checklist for tuition centres, kids' classes and online shops
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
PDPC says a child aged 13 to 17 can give valid consent if your notice and consent wording is readily understandable to them; for children under 13 you must get a parent's or guardian's consent. Treat it as sensitive: collect less, keep location off by default and protect it better.
What the PDPC advisory covers and who it applies to
The Advisory Guidelines on the PDPA for Children's Personal Data in the Digital Environment were issued on 28 March 2024. They apply to organisations whose online products or services are likely to be accessed by children, not only those designed for children. PDPC's examples are social media services, EdTech, online games, and smart toys and devices.
The guidelines define a child as anyone below 18. They are to be read with Chapter 8 of PDPC's Advisory Guidelines on Selected Topics, which covers minors (under 21) in general activities. So a tuition centre's paper enrolment form is covered by the general PDPA rules, and its online portal, app or sign-up form also falls under the children's guidelines.
Consent: under 13, 13 to 17, and when to ask parents anyway
This is the part most businesses ask about.
| Child's age | Who gives consent | PDPC's condition |
|---|---|---|
| Below 13 | Parent or guardian | Must obtain parental consent; notify the parent of the purposes |
| 13 to 17 | The child can give valid consent | Only if the policies and consent wording are readily understandable to the child, including the consequences |
| 13 to 17, child doesn't understand | Parent or guardian | Where you have reason to believe the child doesn't understand, get parental consent |
| Any age, your context calls for it | Parent or guardian | PDPC gives the example of an education setting choosing parental consent for a 13-year-old |
| Turns 18 | Earlier consent stays valid | PDPC treats consent given as a child (or by a parent) as still valid |
PDPC also says children must be able to withdraw consent as easily as they gave it. A one-click opt-in with a withdrawal process by email only would not meet that.
Writing notices and forms children can understand
PDPC says the notification of purpose, consent clauses, data protection policies and terms and conditions must be in language that is readily understandable by children. It suggests age-appropriate language and media such as infographics and short videos, and warns against deceptive language or design.
Ask for age early and only as much as needed
PDPC supports age assurance (self-declaration, estimation or verification) but says to collect the minimum data, and that you don't need national identity documents unless a law requires it.
Branch the form by age
Under 13: collect the parent's name and contact, and get the parent to consent. 13 to 17: show the child-friendly notice, and decide whether your context calls for a parent too.
Write a short child-friendly notice
Plain sentences: what we collect, why, who sees it, how long we keep it, how to say no later. Link the full policy for parents.
Make withdrawal as easy as sign-up
A settings toggle or a one-step form, not a letter or a phone call.
Test the wording
PDPC's own example is a trial run with children of different ages, then adjusting the language.
If you take photos of children at classes or events, our guides to preschool parent apps and child photos and event photography notices cover consent for images.
Data minimisation, profiles and location
PDPC's guidelines push for collecting less, and for safer defaults.
- Account details private by default: PDPC says children's account information must not be public and searchable by default.
- Reasonable purposes: PDPC lists age checks, protecting children from harmful content and directing at-risk searches to safety information as reasonable uses. Using a child's data or profile to target harmful or inappropriate content at them is unreasonable.
- Profiles can become personal data: a declared age alone isn't personal data, but browsing or behaviour data tied to a unique identifier that can identify the child is.
- Location off by default: PDPC recommends disabling precise geolocation by default, using approximate location where possible, collecting it only when needed and showing clearly when it is on.
For a small business, this usually means removing fields you don't use (school name, exact address, NRIC), not adding tracking or marketing pixels to children's portals without thinking it through, and switching off location in any app you commission.
Security and data breaches involving children
PDPC says children's personal data is generally sensitive and must be given a higher standard of protection, and points to the Basic and Enhanced Practices in its Guide to Data Protection Practices for ICT Systems.
Security measures PDPC highlights
On breaches, PDPC says that if a breach causing significant harm affects a child, you must still notify the child, and it encourages informing the parent or guardian too if you have their contact details. If you only have the child's contact, write the notice in language the child understands and suggest they tell a parent. Annex A of the guidelines has sample DPIA questions you can reuse.
A checklist for tuition centres, kids' classes and online shops
Run your current forms and systems against this list.
Children's data checklist
Do it yourself or get help?
Most of this list is form wording and settings you can change yourself in a day: add the age question, split the consent flow, write a short plain-language notice and remove unused fields.
Our PDPA Compliance Pack (S$690) gives you a website privacy policy, a personal data inventory from our online questionnaire, a staff data protection policy, DPO appointment notes, a breach response plan and notification checklist, and a cookie or consent notice. You can use it as the base for the parent and child versions of your notices. It isn't legal advice, and we don't act as your DPO.
Frequently asked questions
PDPC's 2024 advisory guidelines say a child between 13 and 17 may give valid consent if the policies and consent wording are readily understandable to them, including the consequences. For children under 13, organisations must get consent from a parent or guardian. Organisations may choose a higher age, such as parental consent for a 13-year-old in an education setting.
The Advisory Guidelines on the PDPA for Children's Personal Data in the Digital Environment define a child as an individual below 18. They apply to online products and services likely to be accessed by children, not only those made for them, and should be read with PDPC's separate guidance on minors under 21 in general activities.
PDPC's guidelines say children's personal data is generally considered sensitive and must be given a higher standard of protection. PDPC recommends the Basic and Enhanced Practices in its Guide to Data Protection Practices for ICT Systems, such as MFA for admin access, logging, vendor security checks and penetration testing before a new system goes live.
Generally no. PDPC supports age assurance methods such as self-declaration, age estimation or verification, but says organisations should collect the minimum data needed and are not required to collect national identity documents for age assurance unless another law requires it. A simple age or date-of-birth question is often enough.
No. PDPC says consent previously obtained from an individual, or from their parent or guardian, while they were a child remains valid when they reach 18. They can still withdraw consent at any time, and you should make withdrawal as easy as giving consent, as the guidelines recommend.