From today, the office of the Information Commissioner is abolished and its functions transfer to a new corporate body, the Information Commission. The change is made by the Data (Use and Access) Act 2025, brought into force for this purpose by the Commencement No. 9 Regulations (SI 2026/1015).
What changes
- The regulator is now led by a board, with a chair and a chief executive, rather than a single Commissioner.
- It will continue to be known as the ICO, and its existing guidance, codes and decisions remain in effect.
- Your obligations under UK GDPR, the Data Protection Act 2018, and PECR do not change as a result of this step.
There is no need for urgent action, but organisations should update references to the “Information Commissioner” in privacy notices, policies, contracts, and complaints procedures when they are next reviewed.
Source: SI 2026/1015 (legislation.gov.uk)
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
