Ministers have introduced a time‑limited disclosure exception under the Gender Recognition Act 2004 to enable the Cass Review data linkage study. The Gender Recognition (Disclosure of Information) (England) Order 2026 (SI 2026/173) was made on 25 February, laid before Parliament on 26 February, and will come into force on 20 March 2026. The Department of Health and Social Care said the measure is intended to ensure the study proceeds after earlier data‑access barriers. (hansard.parliament.uk)
The Order creates a narrow additional circumstance in which disclosure of “protected information” obtained in an official capacity is not a criminal offence under section 22 of the 2004 Act. The exemption applies only where disclosure is by, and to, authorised persons and is for the purpose of facilitating, assisting with or undertaking the defined data linkage study.
The test is geographic as well as functional. To rely on the exception, both the disclosing and receiving authorised persons must be in England when the disclosure is made. While the instrument extends to England and Wales, it applies in relation to England only.
An “authorised person” is anyone employed by, or authorised in writing to act on behalf of, a body named in the Schedule to the Order. The Schedule includes NHS England; a number of NHS trusts and foundation trusts such as Chelsea and Westminster, Leeds Teaching Hospitals, Mersey Care, Northamptonshire Healthcare, Nottinghamshire Healthcare and University College London Hospitals; the Tavistock and Portman NHS Foundation Trust; GTD Healthcare Limited and the LGBT Foundation; and the Department of Health and Social Care.
The “data linkage study” is defined in the instrument as an observational study, originally commissioned for the independent review into gender identity services for children and young people. It links and analyses data from the former Gender Identity Development Service (GIDS), adult gender clinics and other nationally available NHS datasets, for individuals referred to GIDS who were under 18 at the time of referral.
Article 3 revokes the Gender Recognition (Disclosure of Information) (England) Order 2022 (SI 2022/742), while preserving the position of disclosures made in accordance with that instrument. Ministers said the new Order updates protections and organisational references to reflect that NHS England is now delivering the study and to secure fuller cooperation. (hansard.parliament.uk)
The instrument is time‑limited and ceases to have effect at the end of 20 March 2029. This sunset clause confines the exception to a defined window aligned to completion of the research programme and ensures that any continuation beyond that date would require further parliamentary action.
The Order does not create a general permission to share gender recognition data. It removes potential criminal liability under section 22 only where the strict conditions are met; all other legal duties, including data protection, confidentiality and research ethics requirements, continue to apply. The Secretary of State confirmed updated research and ethical approvals are in train, with the final protocol to be published once approvals are secured. (hansard.parliament.uk)
For NHS data controllers, research sponsors and information governance leads, immediate actions include verifying staff status as “authorised persons”, recording that both parties were in England at the point of any disclosure, and updating data sharing agreements, privacy notices and audit trails to reflect the narrow statutory gateway. Organisations named in the Schedule should brief Caldicott Guardians and SIROs on the geographic test and scope of “protected information”.
The 2026 Order sits within a wider delivery plan to implement recommendations from the independent Cass Review. Officials have restated expectations of full cooperation from relevant organisations so the retrospective study-linking childhood GIDS records with adult NHS data-can commence on schedule following approvals. (hansard.parliament.uk)