California changes disclosure rules for sexual orientation, gender identity, and intersex data
Oct 4, 2026 edition · GC-2026-0128 · Published 2026-10-04 · Version 2 · Final
SB 1114 tightens disclosure controls for identifiable sexual orientation, gender identity and intersex information in specified state data programs, with exceptions and staged implementation provisions.
What happened
California chaptered SB 1114 on September 26, 2026, revising protections for sexual orientation, gender identity and variations in sex characteristics or intersex status, collectively SOGISC. Government Code section 8310.8 identifies the state entities it governs, including health and social-services departments, education agencies and specified workforce and disability agencies. For its disclosure restriction, covered information includes data that could reasonably identify transgender or intersex status, such as gender-marker change records and certain medical information not otherwise protected by HIPAA or California's medical confidentiality law. The measure also addresses teacher-credentialing and higher-education data. Its specified agency and program scope does not create a universal new collection duty for every health care provider.
Identifiable SOGISC information collected under section 8310.8 generally cannot be disclosed outside California state or local government or its authorized agents, subject to defined exceptions for mandatory federal or interstate reporting, enforceable warrants or court orders, public health, qualifying vendors, the Information Practices Act and Civil Rights Department functions. Disclosure must be limited to the minimum required. A separate public-records provision protects SOGISC information subject to its own exceptions, including deidentification. The ordinary effective date is January 1, 2027, but the text supplies specific schedules: Social Services has until January 1, 2028 for the stated disclosure restriction, and separation of shared-program data becomes operative for each covered entity after it notifies the Legislature that necessary automation is complete. These distinctions require program-level implementation planning rather than one assumed deadline.
Scope and timing
- Authority status
- Final
- Applicability
- Directly applicable
- Audience
- Health systems, Provider networks
- Jurisdiction
- California
- Recorded date
- 2027-01-01
- Date type
- effective
Why it matters
Covered agencies and their data partners need to identify direct and inferential SOGISC fields, permitted recipients and the particular statutory exception before transferring identifiable information.
Recommended action
Determine whether the organization or contract participates in a covered state data program. Map identifiable and inferential SOGISC fields, disclosure exceptions, vendor terms and minimum-necessary transfers, and establish the applicable effective, agency-specific and automation-dependent dates with Privacy and Legal.
Sources
- SB 1114, bill historyOfficial · California Legislature · 2026-09-26 · Source review 2026-09-27
- SB1114 chaptered text, retained official rendered documentOfficial · California Legislature · 2026-09-26 · Source review 2026-10-15
- Official Assembly 2023-24 Constitution, Article IV section 8Official · California Legislature · Source review 2026-10-14
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Compliance Sweep report →