ICO to transition to Information Commission on 30 September 2026

In a written statement to the House of Commons on 14 September 2026, Stephanie Peacock, Parliamentary Under-Secretary of State in the Department for Digital, Culture, Media and Sport (DCMS), announced that the transition from the Information Commissioner's Office (ICO) to the new Information Commission (IC) will take place on 30 September 2026.

The announcement comes after the government made the Data (Use and Access) Act 2025 (Commencement No.9 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/1015) on 10 September, which enable the changes, abolishing the ICO and transferring all regulatory powers and responsibilities to the new body. 

The change modernises the ICO's governance structure, shifting from a corporation sole model, where statutory authority was vested in an individual Commissioner, to a body corporate with executive and non-executive members who share collective responsibility for decision-making.

The intention is to bring a broader array of expertise to the new IC's leadership, ensuring the responsible use of personal records across the data-driven economy, and upholding robust data protection standards. The move will also hope to rebuild trust in the regulator, which has recently been rocked by the resignation of former Commissioner John Edwards following an independent HR investigation that found a case to answer over claims of inappropriate sexual language, bullying, and discrimination.  

The statement confirms that the seven non-executive members appointed in July will assume their positions alongside interim Chief Executive Officer (CEO) Paul Arnold MBE on 30 September.

The government has also commenced a public recruitment process to appoint a chair to guide the Commission's strategic direction. 

In a statement responding to the news, the ICO confirmed that it will remain "focused on ensuring a smooth transition and continuity of service for all our customers and stakeholders."

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.