Baby Sleep Consultants Are Responsible for Vulnerable Families and Their Data
A recent BBC investigation into the baby sleep industry* put a long-overdue spotlight on a sector that has grown faster than the rules around it. Most of the coverage, rightly, focused on safety (such as unsafe baby sleep advice), but there's another responsibility sitting like an elephant in the room in the work every sleep consultant does. It’s data protection. This piece is a practical look at the intersection between vulnerability and personal data that sleep consultants have to navigate under GDPR.
@insungpandora on Unsplash
Let me paint you a picture.
It’s 3am. Your longest stretch of sleep in the past month has not been more than two-three hours. You’re pacing up and down with a crying baby and you have no idea why they’re crying. It’s been hours.
Baby stops crying (you don’t know this happened either) and you try to to put them down in their cot slowly, gently, as if you’re holding a ticking bomb. The moment you let go, the crying starts again. Repeat as above.
This is a well-known scenario for new parents who are sleep-deprived, often with their first baby, and just want to do right by their child and get some sleep. So what they do to get help? Of course, they go online.
Their social media algorithms will already know baby sleep advice is what they are interested in, so they will get many suggestions which infant sleep consultants to follow. Then they might pay hundreds of pounds for the promise of a restful night.
Baby Sleep and the GDPR
A sleep consultant can collect a remarkable amount of sensitive information, including special category personal data relating to health. Moreover, the focus of their advice is the baby, so we have an even more sensitive file of data with health information about infants.
Baby data includes:
Name
Date of birth
Weight
Feeding patterns
Medications
Diagnoses
Developmental notes
Photographs and videos of them eating and/or sleeping
Sleep logs that effectively map a family's daily routine
On top of that, we have the parents who will be disclosing:
Basic details like name, contacts details, address
Mental health information, for example if they have postpartum depression
Details about their relationships and working lives
Highly intimate information about the birth and after birth.
What This Means for Baby Sleep Consultants
The practitioners holding all this information are probably sole traders or one-person companies running their businesses from a laptop and a phone via social media, perhaps with no or little formal data protection training and no compliance team to lean on.
This isn't a criticism of the people doing the work, but a recognition that the work itself carries a legal, professional and ethical responsibility that I have never seen the industry name out loud.
However, this doesn’t change the fact that consultants have a serious and responsible job because they are dealing with two sets of vulnerable data subjects.
The individuals whose data is in the spotlight are infants who cannot consent.
The people giving consent on their behalf are, by definition, in a vulnerable life stage.
Sleep consultants are responsible for the wellbeing of babies when they give advice. They're responsible for supporting parents through one of the hardest seasons of family life. This is where the BBC article’s emphasis on the lack of regulation of sleep consultants (I can call myself one tomorrow and start getting clients) overlaps with the the necessity to comply with the GDPR in practice.
The level of compliance with data protection law among sleep consultants is unclear because nobody asks – and why would you, as a new parent? A parent not in the data protection sector would be interested in just the solution, not the privacy notice.
Nevertheless, just like outside the sleep industry, a good supplier will take good care of you personal data, so below is what this may look like in this practice.
Infant Sleep Consultants and Data Protection
GDPR Position of Baby Sleep Consultants
Processing special category data (health) under the UK GDPR, Article 9. This means you as a consultant should record the reasons under data protection that allow you to use it – usually two, but you may have to look at the UK Data Protection Act 2018.
Data subjects are infants who can't consent; parental consent doesn't remove your other obligations to act in the best interests of the child.
Clients are (predominantly) postnatal mums — often sleep-deprived, anxious, sometimes with postnatal depression — a textbook vulnerable group, so "freely given" consent is shakier than usual.
You shouldn’t be pushing your services or additional ones when you can see parents are operating on a few hours sleep and struggling with decisions anyway.
Lawful Basis and Consent
Pick and document your Article 6 and Article 9 basis before you take the first client, not after.
Consent must be specific, informed, granular, and as easy to withdraw as to give.
Bundled consent (sign up = agree to testimonials, marketing, case studies) does not work.
Re-using a client's story for Instagram needs its own separate consent that you can refer to, i.e. written is best.
What Not to Get Wrong
No written privacy notice, or one copied from a template that doesn't match what you actually do. Provide it when you sign a new client up and invite questions – gives credibility.
WhatsApp used for client comms with no retention policy. You don’t want chats to sit on personal phones for years.
Google Drive / Dropbox personal accounts holding client files. Ideally, you would have a separate system for personal use and business purposes.
No Record of Processing Activities which is required if you process special category data (which you do) regardless of size.
Not understanding how your tech tools (Calendly, Stripe, Mailchimp, etc.) use the personal data of parents and their children.
Testimonials with baby's name and photo on the website, consent unclear or undocumented.
Similar to the above, publishing videos of children (something like “before and after” story) is a no go without explicit parental consent. I appreciate this how new business may flow in, but think twice before using this as a marketing strategy at all.
Retention and Deletion
"Keep forever in case they come back" isn't a retention policy.
Decide a period, write it down, actually delete.
Consider what happens to the data if you close the business.
If a parent gives consent for social media sharing but then changes their mind, you must delete the post even if it was popular and had many engagements.
Sharing and Disclosure
If you have consultant group/support chats, do not share identifiable client details. If you do, that’s probably a personal data breach.
If you make referrals to GPs or health visitors, you need explicit parental consent that is documented.
If there are any safeguarding disclosures required, you need to log them and consider when they override confidentiality.
There are other considerations sleep consultants need to put in practice, especially around security of the information, breach readiness, and registering with the ICO whether or not the legal status is sole trader or a company. This blog post can’t cover them all but responsible consultants should get independent advice.
It’s About Trust
Parents are already being asked to trust an unregulated industry on safety. Getting data protection visibly right is one of the few credibility signals available to ethical practitioners.
Post-BBC, "we take your family's privacy seriously and here's how" is a differentiator and enforces trust. It’s the same like for any other business – you want to use GDPR compliance not just as a legal tick but also as a key selling point.
Last but not least, compliance with data protection law means sleep consultants are protecting our most vulnerable and loved members of society – our babies – without unfairly profiting from their parents' exhaustion.
* BBC, Calls for 'urgent action' on baby-sleep industry after BBC investigation online at <https://www.bbc.co.uk/news/articles/c232glp2ej8o> accessed 31.05.2026