Learn how tourism businesses can apply ECPAT and The Code 11.2 through risk checks, staff training, supplier clauses, reporting and evidence.
ECPAT and The Code 11.2: A practical child-protection guide for tourism
Child protection in tourism is an operational responsibility, not a marketing slogan. A company should know where its products, people, suppliers and digital channels may create exposure to sexual exploitation, then build prevention and reporting into normal business controls. The Code sets out six commitments covering policy, staff training, value-chain contracts, traveller information, stakeholder engagement and annual reporting 1.
What are ECPAT, The Code and criterion 11.2?
ECPAT is a global network working to end the sexual exploitation and abuse of children. The Code is a multi-stakeholder initiative supported by ECPAT for the travel and tourism sector. Its official website describes The Code as a voluntary set of criteria for members 1. That distinction matters: membership or alignment with The Code does not replace criminal law, child-protection duties or a company’s responsibility to report suspected offences through the proper channels.
The label “11.2” may appear in a sustainability or audit checklist. The exact wording and evidence expectations can depend on the applicable scheme and version. Organisations should obtain the current checklist from the assessor and map their controls to that document rather than relying on an old template or a general sustainability certificate.
Scope and risk landscape
Risk can arise in hotels, private accommodation, transport, excursions, community visits, booking platforms, airports and local partnerships. ECPAT identifies mobility, perceived anonymity, unequal economic power, limited oversight and technology misuse as factors that can increase vulnerability 2. Volunteer tourism and visits to residential care institutions also require particular safeguarding controls.
A risk assessment should consider the design of the experience, who has access to children, how adults communicate with them, whether supervision exists, what images are collected and how an allegation would be escalated. It should avoid assumptions based on nationality, neighbourhood or poverty.
Requirements and controls
A credible control framework normally includes a senior-approved child-protection policy, a named focal point, a risk register, role-based training and a reporting route. Supplier and guide contracts should express a clear rejection of child sexual exploitation and require cooperation with the company’s safeguarding expectations. Traveller communications should encourage safe behaviour without displaying identifiable or sensational images of children.
For activities involving children, organisations should define boundaries for contact, photography, messaging, volunteering, transport and unsupervised access. ECPAT’s current sector approach also highlights risk assessment, legal analysis, due diligence support, staff training and traveller engagement 2. These are implementation practices that support The Code; they should not be presented as a universal legal checklist.
An implementation process from policy to practice
1. Assign ownership
Name a safeguarding lead and a deputy. Define what frontline employees do, what managers do and when an external authority must be contacted.
2. Map exposure
Review every destination, product, supplier, venue and digital channel. Include seasonal staff, contractors and activities marketed as community or volunteer experiences.
3. Build controls
Update the policy, contracts, recruitment checks where lawful, training plan, photography rules and escalation procedure. Keep controls proportionate to the actual risk.
4. Practise reporting
Use short scenario exercises. Staff should know how to protect immediate safety, record observable facts, avoid confrontation and transfer the matter to the designated route.
5. Review and report
Track training completion, supplier coverage, control failures, corrective actions and annual implementation reporting where required by The Code or the applicable scheme.
Roles and responsibilities
Leadership approves the policy and resources. HR embeds safeguarding into induction and conduct management. Procurement performs supplier due diligence. Operations checks controls at destination level. Guides, drivers, receptionists, housekeeping staff and activity leaders need simple, practical instructions. Marketing protects children’s privacy. The safeguarding focal point maintains the reporting route and coordinates with qualified services or authorities. No frontline employee should conduct a private investigation.
Evidence for an audit or assessment
A useful evidence pack can include the signed policy, risk assessment, training content and attendance records, supplier clauses, due-diligence records, traveller notices, escalation contacts, exercise records, anonymised incident logs, management reviews and corrective-action records. Evidence should demonstrate implementation, not just intent.
Do not include unnecessary names, images or case details of children. Access should be restricted and retention should follow applicable privacy and safeguarding rules. Travelife describes itself as an integrated programme combining learning, management, implementation, supply-chain engagement and independent recognition for travel companies 5; its scope should still be read against the specific standard and assessment contract.
Example scenario
A guest asks a guide to arrange a private meeting with a local minor outside the itinerary. The guide refuses, does not broker contact, informs the operations manager and records the observable facts. If the information indicates an immediate danger or suspected exploitation, the company follows the relevant local reporting route. The guide does not confront the guest, question the child in public or post the incident in a group chat.
Frequently asked questions
Is The Code a legal certification?
No. It is a voluntary sector initiative. National law and any applicable extraterritorial, labour, privacy or reporting rules remain separate obligations.
Is one annual training session enough?
Usually not. Training should be role-specific, refreshed when procedures or risks change and supported by records showing completion and understanding.
Does a sustainability certificate prove compliance with The Code?
Not automatically. Check the scope, version and evidence requirements of the relevant certification or audit. Similar themes do not mean identical criteria.
Should staff collect photos or copies of a child’s identity documents?
Only where lawful, necessary and authorised. Unnecessary collection can create additional privacy and safeguarding risks. Use the least intrusive record that supports a safe referral.
What should a company do when local law is unclear?
Pause unsafe activity, consult a qualified local adviser or competent authority, and update the procedure. Do not treat uncertainty as permission to ignore a safeguarding concern.
Contact us for ECPAT and The Code 11.2 Child Protection consulting for Tourism Businesses in Vietnam.
ISC Global
Hotline/Zalo: +84 933 096 426 – +84 868 591 260
Email: info@iscglobal.asia | van.pham@iscglobal.asia
Website: iscglobal.asia | iscglobal.edu.vn
No responses yet