Gender-history information — information that reveals, or could be used to infer, a person’s gender history or transition — is some of the most sensitive personal data an organisation can hold. This page sets out the framework for handling it lawfully, the confidentiality point the Gender Recognition Act adds, and why a DPIA is the right record. The worked DPIA is held back, because that is what the EqIA/DPIA Wizard delivers.
Special-category data, not ordinary data
Under the UK GDPR and the Data Protection Act 2018, gender-history information is special-category personal data. It attracts a higher threshold of protection than ordinary personal data: you need a lawful basis to process it, and a separate condition for processing special-category data, before you collect, retain or share it. Collecting it “just in case” is not a lawful basis, and the absence of disclosure is not a gap to close. The DPIA prompt set sets out the questions an organisation must answer before it touches this data — minimisation, purpose limitation, who can access it, retention and deletion, security, transparency to the data subject.
The GRA s22 confidentiality point
Section 22 of the Gender Recognition Act 2004 makes it a criminal offence to disclose protected information — that a person has applied for or obtained a Gender Recognition Certificate — where that information was acquired in an official capacity. The exceptions are exhaustive. This sits alongside the data-protection regime and changes the character of the risk: a careless disclosure here is not only a data-protection breach to be reported, it is potentially a criminal matter for the individual who made it. The legal effect of a GRC page sets out the wider frame; for data handling, the practical point is that confidentiality obligations apply over and above the usual.
Why a DPIA is the right record
A Data Protection Impact Assessment is the right record for gender-history processing because it forces the thinking to happen before the data flows, not after. It asks what data, why, on what basis, with what minimisation, accessible to whom, retained for how long, and with what residual risk — and it requires a sign-off. That is precisely the structured reasoning a regulator or a tribunal will expect to see if the processing is ever challenged. The DPIA prompt set gives the questions; the Wizard walks you through them against your specific data flow.
The broader data stance
Gender-history information does not sit in isolation. The monitoring and metrics playbook sets out the wider principle: good monitoring evidences decisions, bad monitoring just collects data you cannot justify holding. Small-number suppression matters here too, because granular breakdowns of a small trans population can identify individuals — including, where a GRC is held, disclosing gender history in breach of section 22. The data stance has to be coherent end to end, not just at the point of collection.
The assessment itself is the part no page can write for you: it has to name your data, your purpose, your lawful basis and your retention. And the whole value of doing one is that the thinking happens before the data starts flowing — not after someone asks why you are holding it.