Data Protection Act 2018

In brief

The UK's primary data protection legislation, supplementing the UK GDPR. Establishes the framework for processing personal data, including special category data (health, sex life, sexual orientation). Gender history and transition status are sensitive personal data requiring explicit consent or another lawful basis for processing.

Key provisions

• s.10 — Special categories of personal data: Defines special categories of personal data, including data concerning health, sex life, and sexual orientation. Gender history and transition status are special category data.
• s.170 — Unlawful obtaining of personal data: Creates a criminal offence of knowingly or recklessly obtaining or disclosing personal data without the consent of the data controller. Maximum penalty is a fine.
• Schedule 1 — Conditions for processing special category data: Sets out the conditions for lawful processing of special category data, including employment, health, and substantial public interest conditions.

When relevant

Handling employees' gender history, pronouns in HR systems, medical records related to transition, and confidentiality of GRC status under both DPA 2018 and GRA 2004 s.22.