ICO Governance Overhaul Complete: Information Commission Took Over on 30 September 2026

The Data (Use and Access) Act 2025's governance reforms are in force. On 30 September 2026 the Information Commissioner's Office moved from a one-person legal structure to a board-led body corporate, the Information Commission, and the regulator kept its familiar name: its own note to editors that day said the legal entity is the Information Commission, while the organisation is referred to as the Information Commission's Office, or ICO.

Information last verified on 1 October 2026.

Status: In force. SI 2026/1015 (C. 83), the Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026, was made on 10 September 2026, and regulation 2 appointed 30 September 2026 as the date on which sections 117(4)(a), 118 and 119 of the Data (Use and Access) Act 2025 came into force. That date has passed. The revised text of sections 118 and 119 on legislation.gov.uk records each as in force at 30.9.2026 by S.I. 2026/1015, reg. 2 (with reg. 3). The office of Information Commissioner is abolished and its functions are now held by the Information Commission.

Jurisdiction scope: This is a UK-wide governance change. The Data Protection Act 2018 provisions being amended extend to England, Wales, Scotland and Northern Ireland (Data Protection Act 2018, section 214). It is not a devolved matter; data protection regulation is reserved to the UK Parliament and applies the same way across all four nations.

What Happened

On 10 September 2026, the government made the Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026, SI 2026/1015 (C. 83). Regulation 2 of that instrument appointed 30 September 2026 as the day on which section 117(4)(a), section 118 and section 119 of the Data (Use and Access) Act 2025 came into force.

Those three provisions carry out the governance reform that Parliament wrote into the Data (Use and Access) Act 2025: replacing the office of Information Commissioner, a corporation sole held by one person, with the Information Commission, a body corporate with collective decision-making.

The reform lands against a backdrop of earlier, separate governance changes at the ICO. In February 2026, Information Commissioner John Edwards voluntarily stepped back from his duties to allow an independent workplace investigation to take place. That investigation later concluded there was "a case to answer", and Paul Arnold, then Deputy Commissioner and Chief Executive, was designated to temporarily take on the Commissioner's responsibilities, a change the ICO announced in June 2026. In July 2026, the government named seven non-executive members to sit on the new Information Commission Board: Laurie Benson, Maggie Carver, Stephen Cohen, Sukhvinder Kaur-Stubbs, Gary Kildare, Hilary Newiss and Scott McPherson. The ICO confirmed in mid-September 2026 that the new board arrangements would take effect on 30 September 2026, the same day as the statutory transfer, and confirmed on the day itself that the non-executive members had formally assumed their roles.

What the Law Actually Says

Section 118 is the abolition provision. It states plainly: "The office of Information Commissioner is abolished." It then amends the Data Protection Act 2018 to strip out everything built around that single office holder: it omits section 114 (which established the office of Information Commissioner) and the heading before it, removes the "Commissioner" entry from the index of defined expressions in section 206, updates the extent provision in section 214, and omits Schedule 12 (the Information Commissioner) in its entirety, the schedule that had set out how the Commissioner's office, staffing and accounts worked.

Section 119 is the transfer provision. Its operative subsection is a single sentence: "The functions of the Information Commissioner are transferred to the Information Commission." A second subsection makes that transfer read across automatically into other law: "So far as is appropriate in consequence of subsection (1), a reference to the Information Commissioner (however expressed) in an enactment or other document whenever passed or made... is to be treated as a reference to the Information Commission." That deeming rule is broad. It covers Acts of Parliament, subordinate legislation, and legislation of the Senedd, the Scottish Parliament and Northern Ireland, so that other statutes which name "the Information Commissioner" do not each need their own amendment.

Section 117(4)(a) is narrower and technical. It omits paragraph (l) from section 205(2) of the Data Protection Act 2018, a list of exceptions to the standard EU rule for calculating time periods. Paragraph (l) had pointed to paragraph 11(5) of the old Schedule 12, the accounts rule for the Information Commissioner's office. Since section 118 removes Schedule 12 altogether, that cross-reference becomes redundant and section 117 replaces it with a new paragraph pointing instead to the schedule governing the Information Commission's accounts.

Together, the three provisions converted the regulator's legal form from a corporation sole into a body corporate, without themselves stating that the regulator's underlying data protection powers change. Anyone checking a current subject access request or ICO complaint process, or the substance of UK GDPR rights, is reading rules that sit elsewhere in the Data Protection Act 2018 and UK GDPR, which these three provisions do not touch.

What Happens Next

On 30 September 2026 the office of Information Commissioner ended and the Information Commission took over, with the seven named non-executive members taking up their roles that day. The ICO published its own confirmation the same day, reporting that it had formally transitioned to the Information Commission, that the Board's non-executive members had assumed their roles, and that the Board had appointed Maggie Carver as Deputy Chair. The regulator also opened a new headquarters on Oxford Road in Manchester. The outstanding appointment is the permanent Chair, whose recruitment the Department for Digital, Culture, Media and Sport is leading and expects to conclude in spring 2027.

The commencement regulations attach a saving provision that governs the handover directly. It states that any act, omission or other thing, including legal proceedings, "done, or... in the process of being done, by or in relation to the Information Commissioner" immediately before 30 September 2026 "is to be treated as an act, omission or thing done or in the process of being done, and capable of being continued, by or in relation to the Information Commission." In other words, the regulations themselves provide for continuity across the changeover, rather than leaving it to be inferred.

A separate saving provision covers the ICO's accounts. For the financial year ending 31 March 2027, the old Schedule 12 accounting rule keeps applying, except that the duties it imposes are now to be carried out by the Information Commission rather than the (now abolished) office of Information Commissioner.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The practical significance of this change is structural rather than substantive. A corporation sole concentrates legal responsibility and decision-making in one named individual; the events of early 2026, when the sitting Commissioner stepped back mid-investigation and a deputy had to be formally designated to carry the office's functions, are the kind of situation a single-office-holder model handles awkwardly, because there is no board to fall back on. A body corporate with a board of seven non-executive members spreads accountability and gives the regulator institutional continuity that does not depend on one person remaining in post.

The section 119(2) deeming rule also matters beyond the ICO's own paperwork. Because it treats "a reference to the Information Commissioner (however expressed)" in any enactment or document as a reference to the Information Commission "so far as is appropriate", other statutes that name the Information Commissioner do not need individual amendment to keep working after 30 September 2026. That is a legal mechanism for continuity, not a statement that every reference elsewhere, including on websites like this one, is automatically updated in the reader's eyes; it is a rule about how the law itself is read, not a rule that retires the term "Information Commissioner" from ordinary usage overnight, particularly since the ICO itself says it is keeping its own brand.

How This Affects You

Nothing in the sources reviewed for this article says that an individual's data protection rights, or the process for exercising them, changed on 30 September 2026. The regulator's own statement on the day said the governance transition does not change its core responsibilities. The right to make a subject access request, the right to ask for erasure of personal data, and the route for bringing a complaint to the ICO all continue to sit in the Data Protection Act 2018 and UK GDPR, none of which these three commencement provisions rewrote.

If you have a complaint, investigation or set of legal proceedings already open with the ICO, the commencement regulations' saving provision is directly on point: it treats anything in progress with the Information Commissioner immediately before 30 September 2026 as continuing, undisturbed, with the Information Commission afterwards. Nothing in the material reviewed suggests a live matter needs to be resubmitted or restarted because of the changeover. If your matter concerns a wider point, such as a data breach compensation claim that also involves civil proceedings against an organisation, that route is unaffected by this governance change, since it does not depend on which entity currently holds the Information Commissioner's regulatory functions.

This article is provided for general informational purposes and is not legal advice. For guidance on a specific complaint, investigation or data protection matter, consult the ICO's own published guidance or a qualified solicitor.

Last updated: 2026-10-01. This is a developing story; details verified as of 2026-10-01.

Frequently Asked Questions

Has the ICO already become the Information Commission?

Yes. The transfer took effect on 30 September 2026 under regulation 2 of SI 2026/1015. The office of Information Commissioner was abolished that day and its functions passed to the Information Commission, and the revised text of sections 118 and 119 of the Data (Use and Access) Act 2025 records both as in force at 30 September 2026. The organisation continues to be known as the ICO.

What changed on 30 September 2026?

The office of Information Commissioner, held by one person, was abolished, and its functions transferred to the Information Commission, a body corporate overseen by a board, under sections 118 and 119 of the Data (Use and Access) Act 2025.

Did the ICO change its name?

No. The ICO's note to editors on 30 September 2026 states: "The legal entity will be known as the Information Commission, which is overseen by the Board. The organisation will be referred to as the Information Commission's Office, or ICO." The legal entity changed; the public-facing name did not.

What happens to a complaint or investigation that is already open with the ICO?

The commencement regulations include a saving provision stating that any act, omission or thing done, or in the process of being done, by the Information Commissioner immediately before 30 September 2026, including legal proceedings, is treated as continued by the Information Commission afterwards.

Who runs the new Information Commission?

The Information Commission is governed by a board rather than a single office holder. Seven non-executive members named in July 2026, Laurie Benson, Maggie Carver, Stephen Cohen, Sukhvinder Kaur-Stubbs, Gary Kildare, Hilary Newiss and Scott McPherson, took up their roles on 30 September 2026. Paul Arnold is Chief Executive Officer of the Information Commission, and the Board appointed Maggie Carver as Deputy Chair on 30 September 2026 pending the recruitment of a permanent Chair by the Department for Digital, Culture, Media and Sport.

Does this change my data protection rights or how I make a subject access request?

The sources reviewed for this article do not describe any change to individual data protection rights or to the process for exercising them. This reform changes the regulator's legal structure, not the underlying rights in the Data Protection Act 2018 and UK GDPR.

Where in the UK does this apply?

UK-wide. The Data Protection Act 2018 provisions being amended extend to England, Wales, Scotland and Northern Ireland under section 214 of that Act.