Skip to content

The Children’s Commissioner’s Office (CCO) collects data on children to produce up-to-date evidence on the lives, experiences, views, and outcomes of children in England. This evidence informs the Children’s Commissioner’s priorities and policy recommendations, enabling her to better represent the rights, interests, and views of children. Apart from in exceptional and clearly specified cases, the data that CCO collects is generally non-identifiable. 

The CCO may collect data directly from you, for example through a survey, interview or focus group; or we may instruct other organisations to provide us with data. We then analyse this data to report general insights, themes, and patterns across many children, rather than the details of a specific child. We never publish any information that could allow a person to be identified unless that person has specifically consented to it or requested it. 

Your privacy

If we collect your personal data from another source, we will: 

If you take part in an interview or focus group with our trained staff, we will ask you (or a parent/guardian) to give your consent before you take part. Consent can be either written where we will ask for a signed consent form, or verbal where we will ask you to confirm verbally that you are happy to give your consent.

Consent forms

If you take part in an interview or focus group with the CCO, we will ask you (or your parent/guardian if you are under 13) to give your consent before starting the session. Consent can be given either through signing a consent form, or stating when you talk to us that you consent to taking part (this is verbal consent).  

Consent, either written or verbal, confirms that you are happy to speak with us, that you understand what is happening, and that you have the right to stop any time for any reason. We will always ask for written or verbal consent so that we are complying with the law and carrying out the work in ethical ways. If you are younger than 13, we will ask your parent/guardian to sign a consent form on your behalf.  

We keep consent forms for as long as we keep the records from the interview or focus group. We keep consent forms because you have the right to withdraw your consent at any time, even after the research has finished.  

Taking part in interviews remotely

You may be invited to take part in an interview remotely which will involve us calling you on the phone or using an online solution such as Microsoft Teams or Zoom.  

If you take part in a remote interview we will always:

Information which will be collected by the online service provider when using an online solution:

The CCO does not keep any of this information. The online service provider will record this data for as long as required but will not provide anyone else with access.  

To find out more about how Zoom processes personal data you can read their privacy notice here

How will we use the information about you?

We use data to provide the Children’s Commissioner with up-to-date evidence on children’s experiences, views, and outcomes. This evidence informs the rest of the work that we do. It also gives the Commissioner the evidence to stand up for children’s rights and represent their voices, and to support her policy recommendations to the government.  

All staff receive training on how to handle personal information confidentially.

The purposes of the processing (Why we use personal data)

he Children’s Commissioner represents the rights and interests of children in England. To do this well, the Commissioner must have the latest evidence and often will look at issues in a way that no other organisation will. Data collected by the CCO will be used to provide this evidence to the Commissioner and answer the questions and address issues that children and young people have told her are important to them.  

The data isn’t just used to make recommendations about changes that are needed nationally. The Commissioner will also provide information to local areas so that they can make positive changes in the services they offer to their communities.  

The CCO does not use data for profiling or automated decision making.  

The lawful basis for the processing

The Children’s Commissioner can instruct individuals in public positions to provide information which they hold to the Commissioner if that data is relevant to issues affecting children. This ability is granted under Section 2F of the Children Act 2004.  

For information to be shared with the Commissioner in this way it must be information which that person can legally share, and the Commissioner must demonstrate that the data is needed to further her work and perform her functions.  

The Children’s Commissioner has a duty to involve children in her work by consulting with them and organisations working with children when investigating issues relating to them. This duty is set out under Section 2B of the Children Act 2004 and provides the lawful basis for research carried out directly with children, such as surveys, interviews or focus groups. Taking part in this kind of research is voluntary and no one has to take part if they don’t want to.   

Section 2E of the Children Act 2004 grants the Children’s Commissioner and her staff the ability to enter premises other than private dwellings for the purpose of conducting interviews with children or observing the standard of care provided to children accommodated or otherwise cared for there. This is the lawful basis used by CCO to conduct interviews in a range of settings including care homes, residential schools, young offenders institutes or hospitals.  

Lawful basis for processing: The Data Protection Act (DPA) 2018 and the General Data Protection Regulations (GDPR) 

The Data Protection Act (DPA) and the General Data Protection Regulations (GDPR) set out the rights of individuals when it comes to their data and the use of data by organisations. The DPA and GDPR have several articles which set out the requirements that organisations need to meet in order to process personal data. There are additional requirements for organisations that need to process sensitive information known as ‘special category’ data.  

Section 2 of the Children Act 2004 sets out that: 

The primary function of the Children’s Commissioner is to promote and protect the rights of children in England. This includes promoting awareness of the views and interests of children in England. In carrying out this function the Commissioner may: consider the potential effect on the rights of children of government policy proposals and government proposals for legislation; and, investigate any other matter relating to the rights or interests of children.  

This function means that the CCO can process personal data under Article 6(1)(e) of GDPR: ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’.  

Sometimes the Commissioner will require information on ‘special category’ data such as ethnicity or disability. More information on ‘special category data can be seen on the ICO website here.  

When we process special category data we do so under GDPR Article 9(2)(g): ‘processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject’ 

In relying on the substantial public interest condition in Article 9(2)(g) the CCO must also demonstrate that it meets one of the 23 specific substantial public interest conditions set out in Part 2 of Schedule 1 of the DPA 2018. 

The substantial public interest condition which is relevant to the CCO is Schedule 1, Part 2(6), ‘statutory and government purposes’.  

Schedule 1 Part 2,6(1) sets out that: 

6 (1) This condition is met if the processing— 

  1. is necessary for a purpose listed in sub-paragraph (2), and 
  1. is necessary for reasons of substantial public interest. 

(2) Those purposes are— 

  1. the exercise of a function conferred on a person by an enactment or rule of law; 
  1. the exercise of a function of the Crown, a Minister of the Crown or a government department. 

The categories of personal data obtained

The CCO collects many different categories of data from different sources. The CCO rarely collects information which could be used to identify you such as name or date of birth. The CCO may collect ‘pseudonymised’ unique identifiers which indicate that a record belongs to a unique individual but does not reveal that person’s identity. Under GDPR this is still personal sensitive data.   

The types of information we collect are: 

How long we keep personal data for

We keep data for five years after we receive it. After that, if the data is no longer required it will be securely destroyed. We may decide to keep data for longer if we have a legitimate reason to keep it, for example, if we still need the data for ongoing research.  

Where we get data from

The CCO gathers data from other public sector bodies such as: 

The CCO occasionally runs surveys directly with children through providers such as: 

The CCO may analyse aggregate, non-identifiable data that we already hold or collect through our other services such as Help at Hand (set out in the Help at Hand Privacy Notice). 

The CCO will also work directly with children for qualitative research. We get in touch with children and young people in lots of different ways, for example through: 

When we share personal information

In some cases, we will share recordings containing your data (what you tell us) with a company so that they can type up a transcript. We can share the transcription company’s privacy and data protection policies with you on request.  

We may also share information we hold about you with other organisations where the law allows it, or if we have a legal obligation to do so, such as: 

There may be some circumstances where we’ll need to share information about you without your consent. For example, to prevent or detect a crime, or to comply with our obligations under safeguarding laws. In all cases, we’ll comply with all data handling legislation including the Data Protection Act 2018. 

How to find out what personal information we hold about you

Under the terms of the Data Protection Act 2018 you are entitled to ask any data controller: 

Requests for your personal information in this way are known as subject access requests. To submit a subject access request please contact [email protected] and say in the subject line that you are submitting a subject access request. If you submit a subject access request, we may ask you to provide some identification, so that we can be sure we are providing the right information to you. Requests should involve a reasonable search for data and may be refused if excessive, unfounded or a restriction applies. 

For most other data we collect, such as that from the Department for Education, we do not collect personally identifiable information. This means that while we may possess large sets of data that may contain your details alongside those of many other children, we will not know which specific data is yours because our data does not include people’s names, addresses or contact details. In cases such as this, you will need to make the subject access request to the original data controller who has provided your data to CCO.  

Right to object

Under UK-GDPR you also have the right to object to any organisation processing your information, where the legal basis for the processing is Article 6(1)(e) of UK-GDPR. If you know that the CCO holds your information you can object to the processing by contacting [email protected] and say in the subject line that you are objecting to the processing of your information.  

Once you have submitted an objection to processing, the CCO will assess the feasibility of your request and delete your information if it is possible to do so.  


If you have any questions about the information provided here or wish to raise a subject access request you can contact us at:  [email protected] 

If you have any questions for our Data Protection Officer you can contact them at: [email protected] 

Individuals in the UK have the right to raise a complaint with the Information Commissioner’s Office (ICO), which is the information supervisory authority for the UK. You can contact the ICO through their website here or call their helpline: 0303 123 1113.  

Changes to research privacy policy

If we decide to change our research privacy policy, we will post those changes on this page, and/or update the privacy policy modification date below.

This policy was last modified on 15th June 2023.