Gender-history information — information that reveals, or could be used to infer, a person’s gender history or transition — is some of the most sensitive personal data an organisation can hold. This page sets out the framework for handling it lawfully, the confidentiality point the Gender Recognition Act adds, and why a DPIA is the right record. The worked DPIA is held back, because that is what the EqIA/DPIA Wizard delivers.
Special-category data, not ordinary data
Under the UK GDPR and the Data Protection Act 2018, gender-history information is special-category personal data. It attracts a higher threshold of protection than ordinary personal data: you need a lawful basis to process it, and a separate condition for processing special-category data, before you collect, retain or share it. Collecting it “just in case” is not a lawful basis, and the absence of disclosure is not a gap to close. The DPIA prompt set sets out the questions an organisation must answer before it touches this data — minimisation, purpose limitation, who can access it, retention and deletion, security, transparency to the data subject.
The GRA s22 confidentiality point
Section 22 of the Gender Recognition Act 2004 creates a duty not to disclose protected information about a person’s gender history, acquired where that information was obtained in an official capacity. This sits alongside the data-protection regime and raises the stakes on a careless disclosure: a breach here is an exposure in its own right, not merely a data-protection matter. The legal effect of a GRC page sets out the wider frame; for data handling, the practical point is that confidentiality obligations apply over and above the usual.
Why a DPIA is the right record
A Data Protection Impact Assessment is the right record for gender-history processing because it forces the thinking to happen before the data flows, not after. It asks what data, why, on what basis, with what minimisation, accessible to whom, retained for how long, and with what residual risk — and it requires a sign-off. That is precisely the structured reasoning a regulator or a tribunal will expect to see if the processing is ever challenged. The DPIA prompt set gives the questions; the Wizard walks you through them against your specific data flow.
The broader data stance
Gender-history information does not sit in isolation. The monitoring and metrics playbook sets out the wider principle: good monitoring evidences decisions, bad monitoring just collects data you cannot justify holding. Small-number suppression matters here too, because granular breakdowns of a small trans population can identify individuals — including, where a GRC is held, disclosing gender history in breach of section 22. The data stance has to be coherent end to end, not just at the point of collection.
Where a data flow carries real exposure, paid support is the right floor. The EqIA/DPIA Wizard produces the record a review would expect; Proportionality Check tests whether the processing is justified on the facts; Consulting weighs it with you on your specifics.