Part 7: Supplementary and final provision Section 208: Children in Scotland
This section applies to Scotland. It provides that a child under 16 can exercise their rights or give consent under the data protection legislation if the child understands what it means to exercise that right or give such consent. A person aged 12 or over is to be presumed to be of sufficient age and maturity to have such understanding unless it is proved otherwise.
	This section is to be read in conjunction with Article 8 of the GDPR. Article 8, read with section 9 of this Act, provides that, in relation to the offer of information society services directly to a child, where the child has themselves given consent to the processing of their personal data, processing shall be lawful where the child is at least 13 years old. Where the child is below the age of 13 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.