ICO Governance Overhaul Confirmed: Information Commission Takes Over 30 September 2026

The regulations bringing the Data (Use and Access) Act 2025's governance reforms into force have been made. From 30 September 2026 the Information Commissioner's Office moves from a one-person legal structure to a board-led body corporate, the Information Commission, though the ICO says it will keep its familiar name.

Information last verified on 20 September 2026.

Status: SI 2026/1015 (C. 83), the Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026, was made on 10 September 2026. It appoints 30 September 2026 as the date on which sections 117(4)(a), 118 and 119 of the Data (Use and Access) Act 2025 come into force. As of 20 September 2026, that date has not yet arrived. The Information Commissioner still holds office and the Information Commission does not yet exist in law.

Jurisdiction scope: This is a UK-wide governance change. The Data Protection Act 2018 provisions being amended extend to England, Wales, Scotland and Northern Ireland (Data Protection Act 2018, section 214). It is not a devolved matter; data protection regulation is reserved to the UK Parliament and applies the same way across all four nations.

What Happened

On 10 September 2026, the government made the Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026, SI 2026/1015 (C. 83). Regulation 2 of that instrument appoints 30 September 2026 as the day on which section 117(4)(a), section 118 and section 119 of the Data (Use and Access) Act 2025 come into force.

Those three provisions carry out the governance reform that Parliament wrote into the Data (Use and Access) Act 2025: replacing the office of Information Commissioner, a corporation sole held by one person, with the Information Commission, a body corporate with collective decision-making.

The reform lands against a backdrop of earlier, separate governance changes at the ICO. In February 2026, Information Commissioner John Edwards voluntarily stepped back from his duties to allow an independent workplace investigation to take place. That investigation later concluded there was "a case to answer", and Paul Arnold, then Deputy Commissioner and Chief Executive, was designated to temporarily take on the Commissioner's responsibilities, a change the ICO announced in June 2026. In July 2026, the government named seven non-executive members to sit on the new Information Commission Board: Laurie Benson, Maggie Carver, Stephen Cohen, Sukhvinder Kaur-Stubbs, Gary Kildare, Hilary Newiss and Scott McPherson. The ICO confirmed in mid-September 2026 that the new board arrangements take effect on 30 September 2026, the same day as the statutory transfer.

What the Law Actually Says

Section 118 is the abolition provision. It states plainly: "The office of Information Commissioner is abolished." It then amends the Data Protection Act 2018 to strip out everything built around that single office holder: it omits section 114 (which established the office of Information Commissioner) and the heading before it, removes the "Commissioner" entry from the index of defined expressions in section 206, updates the extent provision in section 214, and omits Schedule 12 (the Information Commissioner) in its entirety, the schedule that had set out how the Commissioner's office, staffing and accounts worked.

Section 119 is the transfer provision. Its operative subsection is a single sentence: "The functions of the Information Commissioner are transferred to the Information Commission." A second subsection makes that transfer read across automatically into other law: "So far as is appropriate in consequence of subsection (1), a reference to the Information Commissioner (however expressed) in an enactment or other document whenever passed or made... is to be treated as a reference to the Information Commission." That deeming rule is broad. It covers Acts of Parliament, subordinate legislation, and legislation of the Senedd, the Scottish Parliament and Northern Ireland, so that other statutes which name "the Information Commissioner" do not each need their own amendment.

Section 117(4)(a) is narrower and technical. It omits paragraph (l) from section 205(2) of the Data Protection Act 2018, a list of exceptions to the standard EU rule for calculating time periods. Paragraph (l) had pointed to paragraph 11(5) of the old Schedule 12, the accounts rule for the Information Commissioner's office. Since section 118 removes Schedule 12 altogether, that cross-reference becomes redundant and section 117 replaces it with a new paragraph pointing instead to the schedule governing the Information Commission's accounts.

Together, the three provisions convert the regulator's legal form from a corporation sole into a body corporate, without themselves stating that the regulator's underlying data protection powers change. Anyone checking a current subject access request or ICO complaint process, or the substance of UK GDPR rights, is reading rules that sit elsewhere in the Data Protection Act 2018 and UK GDPR, which these three provisions do not touch.

What Happens Next

On 30 September 2026, the office of Information Commissioner ends and the Information Commission takes over, with the seven named non-executive members taking up their roles that day.

The commencement regulations attach a saving provision that governs the handover directly. It states that any act, omission or other thing, including legal proceedings, "done, or... in the process of being done, by or in relation to the Information Commissioner" immediately before 30 September 2026 "is to be treated as an act, omission or thing done or in the process of being done, and capable of being continued, by or in relation to the Information Commission." In other words, the regulations themselves provide for continuity across the changeover, rather than leaving it to be inferred.

A separate saving provision covers the ICO's accounts. For the financial year ending 31 March 2027, the old Schedule 12 accounting rule keeps applying, except that the duties it imposes are now to be carried out by the Information Commission rather than the (now abolished) office of Information Commissioner.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The practical significance of this change is structural rather than substantive. A corporation sole concentrates legal responsibility and decision-making in one named individual; the events of early 2026, when the sitting Commissioner stepped back mid-investigation and a deputy had to be formally designated to carry the office's functions, are the kind of situation a single-office-holder model handles awkwardly, because there is no board to fall back on. A body corporate with a board of seven non-executive members spreads accountability and gives the regulator institutional continuity that does not depend on one person remaining in post.

The section 119(2) deeming rule also matters beyond the ICO's own paperwork. Because it treats "a reference to the Information Commissioner (however expressed)" in any enactment or document as a reference to the Information Commission "so far as is appropriate", other statutes that name the Information Commissioner do not need individual amendment to keep working after 30 September 2026. That is a legal mechanism for continuity, not a statement that every reference elsewhere, including on websites like this one, is automatically updated in the reader's eyes; it is a rule about how the law itself is read, not a rule that retires the term "Information Commissioner" from ordinary usage overnight, particularly since the ICO itself says it is keeping its own brand.

How This Affects You

Nothing in the sources reviewed for this article says that an individual's data protection rights, or the process for exercising them, changes on 30 September 2026. The right to make a subject access request, the right to ask for erasure of personal data, and the route for bringing a complaint to the ICO all continue to sit in the Data Protection Act 2018 and UK GDPR, none of which these three commencement provisions rewrite.

If you have a complaint, investigation or set of legal proceedings already open with the ICO, the commencement regulations' saving provision is directly on point: it treats anything in progress with the Information Commissioner immediately before 30 September 2026 as continuing, undisturbed, with the Information Commission afterwards. Nothing in the material reviewed suggests a live matter needs to be resubmitted or restarted because of the changeover. If your matter concerns a wider point, such as a data breach compensation claim that also involves civil proceedings against an organisation, that route is unaffected by this governance change, since it does not depend on which entity currently holds the Information Commissioner's regulatory functions.

This article is provided for general informational purposes and is not legal advice. For guidance on a specific complaint, investigation or data protection matter, consult the ICO's own published guidance or a qualified solicitor.

Last updated: 2026-09-20. This is a developing story; details verified as of 2026-09-20.