Section 22 GRA: England sets research data rule

From 20 March 2026, a new Statutory Instrument-the Gender Recognition (Disclosure of Information) (England) Order 2026-comes into force. It creates a very specific legal permission to share information that would otherwise be a criminal offence to disclose under Section 22 of the Gender Recognition Act 2004. Ministers say it is needed to deliver an NHS‑led “data linkage study” recommended by the Cass Review. (questions-statements.parliament.uk)

Let’s pin down Section 22 first. This part of the 2004 Act makes it a criminal offence for someone who learned about a person’s gender recognition status “in an official capacity” to tell anyone else. The law calls this “protected information” and it covers details about a person’s application for a Gender Recognition Certificate (GRC) and their gender prior to a full certificate being granted. There are limited existing exceptions, such as when the person consents or to prevent crime. (gov.uk)

The 2026 Order adds one more, tightly drawn exception. For this study only, authorised people working for organisations named in the Order may disclose protected information to one another when it is genuinely needed to facilitate, assist with or carry out the study. It applies in relation to England and is written for a single research project, not for routine care or everyday administration. Think of it as a one‑purpose key, not a master pass. (questions-statements.parliament.uk)

You’ll notice the term “authorised person”. Here, it means someone employed by, or formally authorised in writing to act for, an organisation listed in the Order’s Schedule-NHS England and a set of named NHS trusts and commissioned providers involved in gender services. This is a closed, named circle. It does not give a general right to share information across the public sector. (questions-statements.parliament.uk)

What will the study actually do? It is retrospective. The plan is to link records from the former Gender Identity Development Service (GIDS) for children and young people with adult NHS data and other nationally held datasets. The focus is on people who were referred to GIDS while under 18, so researchers can better understand their healthcare experiences and intermediate outcomes as they move into adulthood. (questions-statements.parliament.uk)

Why look back at GIDS? Because GIDS closed on 31 March 2024 as the NHS moved to regional services led by specialist children’s hospitals. To understand outcomes for those previously referred to GIDS, you need record‑linkage over time-and that’s what this project enables. (england.nhs.uk)

Equally important is what does not change. This Order does not let employers, schools, universities, local authorities or most NHS staff look up or share someone’s gender history. Outside the named research, Section 22 still makes that a criminal offence. Day‑to‑day operational guidance for officials still says not to disclose someone’s previous gender. (gov.uk)

On safeguards, the government says the final research protocol will be published once independent research and ethics approvals are in place. Earlier government documents also stress that outputs will be anonymised and handled in controlled environments with NHS bodies. In practice, the exception lets named teams link data; it does not allow anyone to publish identities. (questions-statements.parliament.uk)

If your records are in scope, you don’t need to do anything. The study uses routine health records and does not require active participation. General data protection rules still apply, and oversight sits with NHS England and research ethics bodies. Look out for NHS England’s transparency information when the protocol is published so you can read the details yourself. (questions-statements.parliament.uk)

For teachers and students, here’s the learning takeaway. Section 22 protects privacy by criminalising certain disclosures made in an official role. Parliament can create time‑limited exceptions for a clear public interest, like completing a defined piece of NHS research. The 2026 Order is an example of that balance: a narrow route to link sensitive records, usable only by named organisations, for one study. (gov.uk)

The politics also matter. Ministers frame this as delivering a key Cass Review recommendation and set an expectation that clinics now cooperate. That helps explain why the measure is study‑specific, with scrutiny flowing through research approvals rather than a wider rewrite of privacy law. We’ll keep watching for the protocol and findings so you can read the evidence first‑hand. (questions-statements.parliament.uk)