Information Commissioner's Office
United KingdomThe UK's independent regulator for data protection and information rights; enforces UK GDPR, DPA 2018 and PECR, as amended by the Data (Use and Access) Act 2025.
- Jurisdiction (head office)
- United Kingdom
- Scope covered
- United Kingdom (UK GDPR, DPA 2018, PECR, FOIA, EIR)
- Type
- Data protection authority
- GRC discipline
- Data protection & privacy
- Statutory / official basis
- Data Protection Act 2018; UK GDPR; Data (Use and Access) Act 2025
- Status
- Current — verified 15 September 2026
Most remaining DUAA data-protection provisions commenced 5 February 2026 (SI 2026/82); the complaints-procedure requirement commenced 19 June 2026. The DUAA's ICO governance provisions — the change to an 'Information Commission' — had not commenced as at 28 August 2026; the ICO states they follow at a later date.
Why it matters
The ICO is the UK’s supervisory authority for UK GDPR, the DPA 2018 and PECR, and the reference point for most of the practical guidance UK privacy work runs on — from the right-of-access guidance to the accountability framework. Two things changed in 2025–26 that are easy to have half-heard. First, the Data (Use and Access) Act 2025 amended the substance: recognised legitimate interests as a lawful basis, relaxed the rules on some automated decision-making, a duty on organisations to operate a data-protection complaints procedure (in force since 19 June 2026), and new ICO powers including compelling witnesses to interview, requiring technical reports, and PECR fines raised to UK GDPR levels — up to £17.5m or 4% of global annual turnover. The ICO has published new and updated guidance across thirteen priority areas and has announced work on a statutory code of practice on AI and automated decision-making.
Second, the thing that has not happened yet: the DUAA also converts the ICO from a corporation sole into an Information Commission with a board structure. As at the verification date that change had not commenced — the regulator is still the ICO, and the ICO itself says the governance provisions follow later. Documents addressed to “the Information Commission” are ahead of the law.