Section 22 of the Gender Recognition Act: what businesses may not disclose about a trans creator

Section 22 of the Gender Recognition Act 2004 makes it a crime to disclose a person's Gender Recognition Certificate application, or their gender before recognition. It applies when the information was learned in an official capacity. That includes information learned while running a business or supplying professional services, so it binds the accountants, agencies and banks that hold a trans creator's ID, tax or payout documents.

It protects only people who have applied for a certificate. It has exceptions, such as consent, and it is not a general privacy right against the public. It is UK law. This guide is written by Beloura, a management agency built for trans creators. It is general information, not legal advice; for a specific situation, check with a solicitor or other qualified adviser.

Which trans creators section 22 protects, and which businesses it binds

Trans creators in the UK often hand the same documents to several businesses at once. An accountant needs ID for tax returns. A bank checks ID to open an account. An agency may hold copies for platform verification and payouts. When those documents show a certificate application or a gender history, section 22 decides what those businesses can do with it.

Who it protects. The section covers information about "a person who has made an application under section 1(1)". That is an application to the Gender Recognition Panel for a certificate. A creator who has applied is covered from the application onward, whether or not the certificate has been granted yet.

Who it binds. The offence applies to anyone who "acquired protected information in an official capacity". Section 22(3) lists three ways to acquire it:

1. Through public office: civil servants, police officers, other public office holders, and local or public authorities. It also covers voluntary organisations.
2. As the person's employer, or prospective employer, or someone employed by them.
3. "In the course of, or otherwise in connection with, the conduct of business or the supply of professional services."

The third route is the one that matters for most creators. An accountant preparing a tax return supplies a professional service. A bank opening an account, or an agency managing a creator's pages, conducts a business. Staff working for those businesses are covered too. The section does not say the information has to come from an official record. It covers information acquired in connection with the business or the service.

Section 22 applies across the UK. Scotland and Northern Ireland can make some of their own disclosure Orders under it.

What counts as protected information

Section 22(2) defines two kinds of protected information about an applicant:

• The application itself, and any later application the person makes under the Act. That a creator applied, when, and what the application contained.
• The person's gender before it became the acquired gender, but only once the application has been granted. This is the gender history, such as a sex marker on an older document or a birth registration.

In practice, documents a creator hands over can carry both kinds. A copy of a certificate shows that an application was made and granted. A birth certificate issued before recognition can show the earlier gender. Paperwork linking a former name to a current name may do the same, depending on what it says.

How HMRC restricts a tax record after a certificate is covered in HMRC and a name or gender change.

The exceptions: when disclosure is not an offence

Section 22(4) lists ten situations where disclosure is not an offence. Disclosure is allowed if:

1. The information does not let the person be identified.
2. The person has agreed to the disclosure.
3. It is gender history information, and the person disclosing it does not know or believe a full certificate has been issued.
4. A court or tribunal has ordered it.
5. It is for starting, or otherwise for, court or tribunal proceedings.
6. It is for preventing or investigating crime.
7. It is made to the Registrar General for England and Wales, Scotland or Northern Ireland.
8. It is for the social security system or a pension scheme.
9. It is allowed by an Order made under section 22(5).
10. It is allowed by another enactment.

The disclosure Orders. For England, Wales and Northern Ireland, the main Order is the (No. 2) Order 2005. The parts that touch business use allow disclosure for obtaining legal advice, by credit reference agencies passing on court or tribunal orders, and by insolvency officeholders doing their work. The same Order also covers some religious decisions and disclosure to a health professional for medical purposes. Scotland has its own 2005 Order on similar lines.

Later Orders cover prisons and offender management, and a time-limited data linkage study on gender identity services for children and young people, run by named health bodies in England until March 2029.

None of these Orders creates an exception for routine business use, such as account set-up, marketing or casual mention between staff.

What it means for agencies, accountants and banks holding a creator's documents

This section describes what the law covers. It does not describe how any particular business behaves.

• An agency that receives a creator's certificate, older ID or birth certificate in connection with its business is bound by section 22. Passing that information to a platform, a chat team, a photographer or another client is an offence unless an exception applies.
• Consent is the exception that usually fits. If documents genuinely need to reach a platform for verification, the creator can agree to that specific disclosure. Written agreement leaves a record of what was agreed. Creators can also send verification documents to a platform themselves, so the agency never forwards them.
• Sharing less is the strongest protection. A creator can ask which document a business actually needs. Current ID often does not show gender history, so older documents may not be needed at all. Any written consent can name the one recipient and purpose it covers. A consent note that mentions a certificate is itself a record of gender history, so the creator can keep it rather than leave copies with the business.
• An accountant preparing returns supplies a professional service. Telling anyone else about a client's application or gender history, outside an exception, is covered.
• A bank acquires information in the course of its business. Its staff are bound in the same way.
• The exceptions still apply to them. Any of these businesses can disclose for legal advice, under a court order, or to prevent or investigate crime.

A creator who is leaving an agency can ask which documents it holds and what happens to them. The guide on leaving an agency covers collecting logins and documents, and the guide on questions to ask an agency covers who holds ID before signing.

What section 22 does not cover

The section is narrow. It does not cover:

• People who have not applied for a certificate. GOV.UK says a certificate is not needed to update a passport, driving licence, medical records or employment records. Many trans people update those without applying, and section 22 does not protect them.
• Information learned outside an official capacity. A friend, family member, ex-partner or fan who learns something in private life is not bound by section 22.
• The public at large. Someone who reads something online and repeats it has not acquired it in an official capacity.
• A creator's own disclosures. Section 22 limits what others may disclose. It does not stop anyone talking about their own history.

Where section 22 does not reach, other law, such as data protection law, may still apply; a solicitor can advise. A threat to reveal someone's history in exchange for money can be a separate criminal offence, and the police can advise. The guide on threats to out a creator covers that situation.

The penalty, and how to report a breach

Section 22(8) sets the penalty: a fine on summary conviction, not exceeding level 5 on the standard scale. Summary conviction means the case is tried without a jury, in a magistrates' court in England and Wales. Section 22 does not provide for prison.

In England and Wales, level 5 was £5,000. Section 85 of the Legal Aid, Sentencing and Punishment of Offenders Act 2012 removed that limit. For offences committed on or after 12 March 2015, the fine can be any amount. Scotland and Northern Ireland set their own figures.

Section 22 is a criminal offence, so a suspected breach is a matter for the police. Before reporting, it helps to write down:

1. Who disclosed the information, and to whom.
2. How that person or business got the information.
3. When the disclosure happened, with any messages, emails or screenshots.
4. Whether any consent was given, and what it covered.

A complaint to the business itself, or to its professional body, is a separate route. A solicitor can advise on whether a civil claim is also possible.

Where to read the law

The official texts are on legislation.gov.uk, the UK government's legislation site, and GOV.UK. This guide was checked against:

• Gender Recognition Act 2004, section 22 (Prohibition on disclosure of information), on legislation.gov.uk.
• The Gender Recognition (Disclosure of Information) (England, Wales and Northern Ireland) (No. 2) Order 2005, SI 2005/916.
• The Gender Recognition (Disclosure of Information) (Scotland) Order 2005, SSI 2005/125.
• The Gender Recognition (Disclosure of Information) (England and Wales) Order 2021, SI 2021/1020, and (Scotland) Order 2023, SSI 2023/364.
• The Gender Recognition (Disclosure of Information) (England) Order 2026, SI 2026/173.
• Sentencing Act 2020, section 122, and Legal Aid, Sentencing and Punishment of Offenders Act 2012, section 85, on fines.
• GOV.UK: "Apply for a Gender Recognition Certificate".

What changed

• 3 October 2026: first published. Section 22, the disclosure Orders and the fines provisions were read on legislation.gov.uk, and the GOV.UK certificate page on GOV.UK, on that date.