Trans people have good reason to fear abuse of their data by big organisations. Recent legal developments, including a beefing up of the Data Protection Act and “GDPR” appear to provide protection. But is that protection adequate? And do organisations take any real notice of the law when it comes to data processing?