The Information Commission: the end of the ICO as a one-person regulator
In short: The Information Commission is the statutory board that replaced the Information Commissioner as the UK data protection regulator on 30 September 2026. Section 117 of the Data (Use and Access) Act 2025, largely in force since 20 August 2025, established the Information Commission as a body corporate led by a chair, chief executive and other members; sections 118 and 119 abolished the Commissioner as a corporation sole and transferred its functions to the Commission with effect from 30 September 2026 (SI 2026/1015).
For as long as there has been UK data protection law, one named person has held the regulator’s powers. Parliament legislated to end that. The Data (Use and Access) Act 2025 abolished the office of Information Commissioner and transferred its functions to a new body corporate, the Information Commission, governed by a board rather than a single office-holder, with effect from 30 September 2026. The Information Commissioner’s Office records the change in its annual report for 2025/26, laid before Parliament on 14 July 2026, which it expects to be its last full year in the present form. The governance change is only one part of the DUAA, which also reshaped the substance of data protection law; but the reconstitution of the regulator is a change of its corporate governance, and it follows the same path telecoms took when Oftel became Ofcom: a single office-holder replaced by a statutory board.
Key findings (ICO Annual Report 2025/26)
- The Data (Use and Access) Act 2025 abolished the Information Commissioner as a corporation sole and transferred its functions to the Information Commission, a statutory board, with effect from 30 September 2026 (SI 2026/1015, reg 2). Source: ICO, The Information Commission.
- The regulator imposed £33.848m in monetary penalties in 2025/26, up from £4.426m the year before; £18.259m of that is under appeal. Source: ICO Annual Report 2025/26, financial performance summary.
- The largest fine was £14,472,500 to Reddit for failing to apply robust age assurance before processing children’s data. Source: ICO Annual Report 2025/26.
- Cookie compliance work brought 979 of the top 1,000 UK websites into line, which the ICO estimates gives around 40 million people control over online tracking. Source: ICO Annual Report 2025/26.
- John Edwards resigned as Information Commissioner on 19 June 2026 following an independent workplace investigation that found a case to answer; Paul Arnold is Interim Chief Executive Designate of the Information Commission. Source: ICO Annual Report 2025/26, Introduction.
| Enforcement in 2025/26 | Figure | What the ICO did |
|---|---|---|
| Total monetary penalties imposed | £33.848m (2024/25: £4.426m) | Concentrated a higher penalty total in fewer, larger actions |
| Penalties under appeal | £18.259m | Not recognised in the financial statements pending appeal |
| £14,472,500 | Fined for failing to apply robust age assurance for under-13s | |
| 23andMe | £2,310,000 | Fined for security failings under Articles 5(1)(f) and 32(1) UK GDPR, after a joint investigation with Canada |
| MediaLab (Imgur) | £247,590 | Fined for processing children’s data without age checks or a lawful basis |
| Green Spark Energy and Home Improvement Marketing | £250,000 and £300,000 | Fined for robocalls breaching regulation 19 of PECR |
What the Data (Use and Access) Act 2025 changes
Sections 117 to 119 of the Data (Use and Access) Act 2025 change the regulator’s legal form and transfer its existing functions to the new body; on their own they do not alter what data protection law requires. The office has been a corporation sole since the Data Protection Act 1984 created the Data Protection Registrar (Schedule 2), a form the Data Protection Act 1998 continued when it renamed the office the Data Protection Commissioner and the Data Protection Act 2018 carried forward as the Information Commissioner. Section 117 inserts a new section 114A into the DPA 2018 to establish the Information Commission; section 118 abolishes the office of Information Commissioner; and section 119 transfers the functions. Schedule 14 sets out how the board is composed and run.
In place of one office-holder, the Commission is a body corporate led by a chair, a chief executive and other executive and non-executive members with shared responsibility for decisions. The DUAA also gave the regulator, for the first time, a statutory principal objective: to secure an appropriate level of protection for personal data and to promote public trust and confidence in how personal data is used, while having regard to innovation and competition, the prevention of crime, public and national security, and the protection of children. The board has inherited that objective and the data protection framework as the DUAA has reshaped it, including the amended UK GDPR and DPA 2018 and the Privacy and Electronic Communications Regulations 2003. The reshaping is substantial: the DUAA added a recognised-legitimate-interests lawful basis, recast the rules on automated decision-making and strengthened the regulator’s enforcement powers, all set out in our guide to the Data (Use and Access) Act 2025. The reconstitution of the regulator is a separate strand: Parliament legislated for it, and sections 118 and 119 were brought into force by a separate order, SI 2026/1015, on 30 September 2026.
The Act commenced in stages: section 117 established the Commission as a body ahead of the transfer, and a later order brought sections 118 and 119 into force to abolish the office and move the functions across. Paul Arnold served as Interim Chief Executive Designate of the Information Commission before the transfer, and the consequential and transitional Regulations made on 26 March 2026 took effect when the transfer of functions was commenced. That order, SI 2026/1015, brought sections 118 and 119 into force on 30 September 2026.
The Oftel-to-Ofcom precedent
There is a close precedent for replacing a single regulatory office-holder with a board, and it comes from telecoms. When British Telecommunications was privatised, the Telecommunications Act 1984 created the office of Director General of Telecommunications, supported by the Office of Telecommunications, or Oftel. As with the Information Commissioner, the powers to license and to enforce were vested in one named person. That model held for almost twenty years. The Office of Communications Act 2002 then created Ofcom as a body corporate, and the Communications Act 2003 gave it its functions; Ofcom took full powers on 29 December 2003, when the Director General of Telecommunications and Oftel were abolished.
The parallel holds on the constitutional point but there was one big difference. Oftel becoming Ofcom was mainly a merger: five regulators, including Oftel, the Independent Television Commission, the Radio Authority, the Radiocommunications Agency and the Broadcasting Standards Commission, were folded into one converged body to deal with the convergence of telecoms and broadcasting. The move from a Director General of Telecommunications to a board came with that reorganisation rather than as its purpose. The ICO change carries no merger. The Commission has taken exactly the same functions that the Commissioner held. What the two share is the core constitutional move, from powers held by one office-holder to powers exercised by a collective board, and the reasons a board is thought better: resilience against the loss of a single office-holder, and clearer independent accountability of the kind most other UK regulators, including Ofcom, the Financial Conduct Authority and the Competition and Markets Authority, already have.
| Feature | Oftel to Ofcom | Commissioner to Information Commission |
|---|---|---|
| Old form | Director General of Telecommunications (single office-holder) | Information Commissioner (corporation sole) |
| New form | Ofcom, a body corporate with a board | Information Commission, a statutory board |
| Governing statute | Office of Communications Act 2002; Communications Act 2003 | Data (Use and Access) Act 2025, ss.117 to 119 |
| Merger of regulators | Yes: five bodies combined | No: same functions, same organisation |
| Main driver | Convergence of telecoms and broadcasting | Governance resilience and independent accountability |
| Effective | 29 December 2003 | 30 September 2026 |
The corporate governance case for a board
The change is best understood as corporate governance. Until 30 September 2026 the Information Commissioner held the regulator’s statutory powers personally, and the board of non-executive directors that sat alongside the office was, on the regulator’s own account, advisory only: the non-executives gave counsel but did not exercise the functions. The Information Commission replaces that with a conventional statutory board, on which executive and non-executive members share responsibility for the regulator’s decisions. The non-executives move from advising an office-holder to governing the body. That is the standard corporate governance model for a UK regulator, and it is the model Parliament has chosen to bring data protection into line with Ofcom, the Financial Conduct Authority and the Competition and Markets Authority.
A board changes how the regulator works even where the law it enforces does not move. Accountability shifts from one person to several: under a corporation sole, responsibility for every reserved decision rests with the office-holder, whereas a board shares and minutes those decisions, with the chair and chief executive holding distinct roles. Resilience improves. The report is candid that the corporation sole model concentrates risk, because when the office-holder is unavailable the reserved functions pass to deputies under the scheme of delegation but the organisation still turns on a single appointment. The exercise of discretion changes too: data protection enforcement depends on judgement about which cases to take and how hard to press them, and a board spreads that judgement rather than leaving it with one person.
The report ties the change to John Edwards’s departure. He stepped back from his duties on 26 February 2026 to allow an independent workplace investigation relating to him; on 10 June 2026 that investigation concluded there was a case to answer, and he was found temporarily unable to act; he resigned on 19 June 2026. During that period the reserved functions passed to the Deputy Commissioners under Schedule 12 of the DPA 2018, and Paul Arnold, already Interim Chief Executive Designate of the Information Commission, took on the non-delegable responsibilities. In the Senior Independent Director’s report, the regulator states that the board model will make it easier to act in circumstances of that kind. Those are the facts as the report records them. A governance structure that carries a live continuity risk in a single appointment is one worth changing, and this is the year the regulator has said so in terms.
Enforcement in a transition year
While the constitution changed on paper, the enforcement record moved in a clear direction. The ICO imposed £33.848m in monetary penalties in 2025/26, against £4.426m the year before, and £18.259m of that is under appeal. The report attributes the shift to a transformation programme that has, in its words, modernised how it identifies and selects regulatory interventions, producing a more focused enforcement pipeline. Read alongside the figures, the pattern is fewer but larger actions, concentrated in the causes the regulator has named as priorities: children’s privacy, artificial intelligence and biometrics, and online tracking.
The two children’s-data fines are the largest single category, led by the Reddit penalty. The ICO fined Reddit £14,472,500 for failing to apply robust age assurance before processing the data of children under 13, and MediaLab £247,590 over its Imgur platform for the same class of failure. It fined 23andMe £2,310,000 for security failings under Articles 5(1)(f) and 32(1) of the UK GDPR, after a joint investigation with the Office of the Privacy Commissioner of Canada, following a cyber-attack that reached the data of more than 155,000 UK users. On nuisance marketing, it fined Green Spark Energy £250,000 and Home Improvement Marketing £300,000 for robocalls that breached regulation 19 of PECR. The same year carried the ICO’s enabling side: cookie-compliance action the ICO says brought 979 of the top 1,000 UK websites into line, a new AI and biometrics strategy, and a planned statutory code of practice on AI and automated decision-making, which the ICO says will give businesses a single set of rules. The regulator puts the economic value of its work at around £233m for UK businesses over five years.
What the change means for organisations
For most organisations the change of the regulator’s form did not move the day-to-day position when the Commission took over on 30 September 2026. It alters no compliance obligation in itself: the guidance carries over, and existing decisions, notices and correspondence remain valid. A data controller with an open ICO matter does not need to restart it, and a UK data protection compliance programme runs against the DPA 2018, the UK GDPR and the DUAA amendments, not against the change of the regulator’s name. The one operational point to note is that references in older documents and contracts to the “Information Commissioner” are now to be read, so far as appropriate, as references to the Information Commission (Data (Use and Access) Act 2025, s 119(2)); new templates should adopt the new name.
The enforcement signal matters more to most organisations than the change of name. A board-run regulator running a more focused pipeline is likely to keep concentrating its heaviest interventions where public and political salience is highest, which on this year’s evidence means children’s data, data security and online tracking. Organisations in those areas face selective but severe scrutiny. A quiet enforcement in-tray outside those priorities is not evidence of a soft posture: the same programme that produced the larger fines also decides which cases never get opened. Where an organisation is already dealing with the regulator, the shift from a single office-holder to a board makes little practical difference to how a case is run, though decisions on the largest matters will in future be board decisions. If you are responding to an information notice or an enquiry, our investigations and enforcement support page sets out the scope of that work.
Viewpoint
I worked in telecoms regulation through the Oftel era, and the move to Ofcom changed the regulator’s behaviour more than the legislation made it look. The form of a regulator shapes how it acts over time: a board argues before it decides and records why, which makes it steadier and harder to knock off course than a single office-holder. The Information Commission should, on the same logic, become a more predictable regulator, which is what the businesses I advise want most from it. Sections 118 and 119 came into force on 30 September 2026, so contracts and privacy notices that still name the Information Commissioner need updating. The open question is whether the more focused enforcement approach continues once a board, not one Commissioner, is choosing the cases. The governance change is the headline, but for data controllers the enforcement posture is the part that will be felt first.
Frequently asked questions
What is the Information Commission?
The Information Commission is the statutory board that, since 30 September 2026, has been the UK regulator for data protection and information rights in place of the Information Commissioner. It is established by section 117 of the Data (Use and Access) Act 2025, which inserts section 114A into the Data Protection Act 2018. It is a body corporate led by a chair, a chief executive and other members, and holds the functions that the Information Commissioner exercised until 30 September 2026.
When did the Information Commission take over from the ICO?
The change took effect on 30 September 2026, when the Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/1015) brought sections 118 and 119 into force. Anything done by or in relation to the Information Commissioner before that date is treated as done by or in relation to the Commission (SI 2026/1015, reg 3).
How is the Information Commission like the Oftel-to-Ofcom change?
Both replace a single regulatory office-holder with a board. The Director General of Telecommunications, who ran Oftel under the Telecommunications Act 1984, was replaced by Ofcom, a body corporate, in December 2003. The difference is that Ofcom was a merger of five regulators driven by convergence, whereas the Information Commission takes the same functions and organisation as the ICO with no merger.
Does the change affect my data protection compliance?
Not directly. The move to a board does not itself change the law you must comply with, and existing guidance, decisions and notices carry over. The DUAA’s substantive reforms to data protection law are a separate matter. References to the “Information Commissioner” in contracts and privacy notices are now read, so far as appropriate, as references to the Information Commission (Data (Use and Access) Act 2025, s 119(2)).
For advice on responding to an ICO enquiry, or on how the move to the Information Commission affects your data protection documentation, contact Rob Bratby at Bratby Law.
