It has been announced that the functions of the ICO (Information Commissioner’s Office) will be taken over by the Information Commission with effect from 30 September 2026.
The Parliamentary Under-Secretary of State Stephanie Peacock announced on 14 September 2026 that the Information Commission will take over all of the functions and responsibilities of the ICO.
She goes on to state, in her written statement that this “marks an important milestone in the modernisation of the UK’s data protection regulator” and that it is designed to ensure that the regulator is equipped to meet future challenges and seize opportunities. She points out that the ICO was a corporation sole with powers and responsibilities vested in one individual: the Information Commissioner. The new Commission will function as a body corporate with non-executive and executive members and a collective responsibility for decision making.
Regulations have been made which abolish the ICO’s office: the Data (Use and Access) Act 2025 (Commencement No.9 and Transitional and Saving Provisions) Regulations 2026. These Regulations bring into force sections 117(4)(a), 118 and 119 of the Data (Use and Access) Act 2025.
The statement goes onto say that this transition represents a new beginning for the regulator and that the Commission must be an organisation that people trust. “Trust starts with strong leadership, clear accountability and the right culture”. It would appear to be implicit in the Honourable Member’s statement that this is a status the ICO does not currently enjoy.
It appears that for the time being the regulator will still be referred to as the ICO but naming conventions will be updated in due course by the new Commission. The ICO website confirms the governance changes and states simply that the ICO “remains focused on ensuring a smooth transition and continuity of service for all customers and stakeholders.”
It is to be assumed that complaints relating to misuse of data may still be submitted to the ICO up to and including 30 September 2026. From 30 September 2026 onwards the ICO will, we assume, keep the website remain operational at least for a transitional period and in due course will either rebrand/rename it or direct users to a new website via a redirect link.
In the writer’s view it’s unlikely that a complaint will be rejected if it is incorrectly addressed to the ICO from 30 September 2026 but at the time of writing there is very little information to go on. Addressing any new complaints to the Information Commission will likely achieve the same effect since the ICO will become the Information Commission. Other than the change of name (and the new Board) will it simply be business as usual?
