Section 81 amends Article 25 of the UK GDPR about data protection by design and by default to strengthen protections of children’s personal data.
	Article 25(1) of the UK GDPR provides that controllers must implement appropriate technical and organisational measures in order to meet the requirements of the UK GDPR and protect the rights of data subjects. When deciding which measures are appropriate, the controller must take into account the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity to people’s rights posed by the processing. This duty applies at the time of determination of the means for processing and during the processing itself.
	Section 81(2) inserts new paragraph (1A) and (1B) to Article 25 of the UK GDPR.
	Paragraph (1A) creates an express duty for controllers providing information society services likely to be accessed by children to consider the matters in new paragraph 1B when designing and implementing their processing activities. Taken together, these matters are referred to as ‘children’s higher protection matters'.
	For the purposes of the UK GDPR, information society services are defined as "any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services" (see Article 4(25) of the UK GDPR). In practice these are online services of a commercial nature.
	New Article 25(1B), subsections (a) and (b) set out specifics of this duty. They require relevant controllers to consider how best to protect and support children when they are using their services; to take account of the fact that children merit specific protection because they may be less aware of the risks and their rights in relation to the processing activities; and to take account of the fact that children have different needs at different ages and different stages of development.
	Section 81(3) makes a consequential amendment that is self-explanatory.
	Section 81(4) adds paragraph (4) to Article 25 of the UK GDPR. It is a technical provision that confirms that other organisations that process children’s personal data may need to consider the issues in new Article 25(1A) and (1B), on a case-by case basis and depending on the context, as per the status quo. It is included to ensure the new duty does not imply anything about the factors other organisations may need to consider when implementing organisational and technical measures under Article 25(1) UK GDPR.
	Section 81(4) also adds paragraph (5) to Article 25 of the UK GDPR, which excludes preventive and counselling services from the definition of "information society services" for the purpose of this provision.
Part 5: Data Protection and Privacy Obligations of controllers Section 81: Data protection by design: children’s higher protection matters: