New Information Commission to replace the ICO from 30 September 2026

The UK Government has confirmed that the Information Commission will officially replace the Information Commissioner's Office (ICO) on 30 September 2026. 

The change follows reforms introduced by the Data (Use and Access) Act 2025, which seeks to modernise the UK's data protection framework and reform the governance of the UK's privacy regulator. From the end of September, all regulatory functions, powers and responsibilities currently exercised by the ICO will transfer to the newly established Information Commission. 

For most organisations, the transition is expected to have little immediate practical impact. The regulator will continue to oversee compliance with UK data protection legislation, handle complaints, investigate breaches and take enforcement action where necessary. However, the establishment of the Information Commission represents a significant constitutional change and may influence the future direction of UK data protection regulation.

The most notable change is not the regulator's name, but its governance structure. The ICO currently operates as a ‘corporation-sole’, with powers and responsibilities vested in a single Information Commissioner. Those functions will transfer to the Information Commission, comprising a Chair, executive and non-executive members with collective responsibility for decision-making. This board-led model will bring the regulator more closely into line with other major regulators and public bodies. 

The Government has stated that the new structure is intended to strengthen accountability, resilience and decision-making by drawing on a broader range of skills, experience and perspectives. It is also designed to ensure that the regulator is better equipped to respond to rapid technological change, increasingly complex digital services and growing public expectations around transparency and accountability.

In July 2026, the Government announced the appointment of seven non-executive members to the new Commission.  Together with interim Chief Executive Paul Arnold, they will assume their roles on 30 September, while recruitment for a permanent Chair continues. The Government has highlighted the board's combined expertise across business, technology, regulation, governance and public service as a key factor in helping to shape the Commission's strategic direction.

The Information Commission will take on its responsibilities at a time when data protection issues are becoming increasingly complex, particularly in relation to artificial intelligence and other data-driven technologies.  For businesses, charities and public sector organisations, the transition serves as a reminder of the continued importance of strong information governance and effective oversight. 

More than a rebranding exercise, the creation of the Information Commission signals a new chapter for the UK's independent data protection regulator and provides an early indication of the Government's longer-term vision for privacy regulation in the UK.