The ICO Is Now the Information Commission: What It Means for Your Business

On 30 September 2026, the UK’s data protection regulator changed. The Information Commissioner’s Office was replaced by the Information Commission, a new board-led body created by the Data (Use and Access) Act 2025.

For most employers, the day-to-day impact is small. But the change is part of a wider push to make the regulator more accountable and better equipped to investigate, so it’s worth understanding.

What is the Information Commission?

The Information Commission is the UK’s data protection regulator. It replaces the Information Commissioner as a single office-holder with a corporate board of executive and non-executive members who share responsibility for decisions. The chair still holds the title Information Commissioner, and the regulator is still known as the ICO, now standing for the Information Commission’s Office.

What has changed with the Information Commission?

• Governance: a board of between 3 and 14 members, including a chair, non-executive members and a chief executive. Non-executives must, so far as practicable, outnumber executives.
• Accountability: the regulator must now publish annual performance data against key performance indicators and an annual report on regulatory action, including investigations and the powers used.
• Investigatory powers: since February 2026 the regulator can require individuals to attend interviews and answer questions, and can require an organisation to commission and pay for an independent technical report in serious cases.

What hasn’t changed?

• UK GDPR and the Data Protection Act 2018 still apply.
• Existing investigations, enforcement action and legal proceedings carry over automatically.
• References to the “Information Commissioner” in existing documents are treated as references to the new Commission.
• Maximum fines under UK GDPR are unchanged.

What should employers do?

Very little immediately, and there was no hard deadline. Sensible housekeeping:

• Privacy notices: when they’re next reviewed, update “Information Commissioner’s Office” to “Information Commission’s Office”. References that just say “ICO” can stay.
• Policies and complaints procedures: make the same change at the next scheduled review.
• Training content: refresh any data protection training that names the regulator, and use it as a prompt to check your staff are up to date on UK GDPR and the DUAA changes.
• Readiness for scrutiny: with stronger investigatory powers and a regulator under pressure to show results, make sure you can evidence your data protection training, policies and decisions.

Frequently asked questions

Do we need to rewrite our privacy notice now?

No. Existing references are protected by continuity provisions. Update the regulator’s full name at your next routine review.

Is the ICO name disappearing?

No. The regulator continues to use “ICO”, now as the Information Commission’s Office.

Will fines increase?

Not automatically. The maximum penalties are unchanged, but stronger investigatory powers and published performance data mean more visible enforcement is likely over time.

How PeopleFirstHR can help

A regulator with stronger powers is a good reason to make sure your people know the basics. PeopleFirstHR Limited supplies Astute eLearning by VinciWorks, including UK GDPR and Data (Use and Access) Act courses, with reporting that shows who has completed training and when.

Book a 20-minute Astute demo with PeopleFirstHR.