The UK's primary data protection legislation, supplementing the UK GDPR. Establishes the framework for processing personal data, including special category data (health, sex life, sexual orientation). Gender history and transition status are sensitive personal data requiring explicit consent or another lawful basis for processing.
Key provisions
s.10 — Special categories of personal data: Defines special categories of personal data, including data concerning health, sex life, and sexual orientation. Gender history and transition status are special category data.
s.170 — Unlawful obtaining of personal data: Creates a criminal offence of knowingly or recklessly obtaining or disclosing personal data without the consent of the data controller. Maximum penalty is a fine.
Schedule 1 — Conditions for processing special category data: Sets out the conditions for lawful processing of special category data, including employment, health, and substantial public interest conditions.
When relevant
Handling employees' gender history, pronouns in HR systems, medical records related to transition, and confidentiality of GRC status under both DPA 2018 and GRA 2004 s.22.
Take this further
Assess your organisation
See how your policies and practice measure up against this authority — and the other 121 in the catalogue — with the toolkit's free diagnostic.
We use analytics cookies to understand how visitors use this site so we can improve it. We
only set them if you accept. See our privacy policy for details.