Regulatory · News analysis
Navigating the Transition: What the New UK Information Commission Means for Businesses
The ICO became the Information Commission on 30 September 2026. What changed, what did not, and what it means for your UK representative arrangements.
On 30 September 2026 the Information Commissioner’s Office (ICO) became the Information Commission. The change was made by the Data (Use and Access) Act 2025 and concerns how the regulator is governed: the seven non-executive members of a new board took up their roles on that date.
Day to day, little changes for businesses. The regulator says it keeps its existing regulatory functions and responsibilities, and that it will continue to be known as the ICO. Its announcement does not ask organisations to do anything because of the transition.
What this means for you
- Keep referring to the ICO in privacy notices, policies and complaint routes.
- Treat the transition as a change of governance, not of the rules: on its own, it does not change your obligations under the UK GDPR.
- If your organisation is outside the UK and offers goods or services to people in the UK, or monitors their behaviour there, Article 27 of the UK GDPR may require you to appoint a UK representative. The transition does not change that requirement or what a representative does.
We will update this article if the Information Commission announces changes to its priorities or approach.
Sources & further reading
- Official announcement
ICO to become Information Commission on 30 September 2026 (opens in a new tab)
ICO · 15 September 2026 · updated 17 September 2026
- Legislation
legislation.gov.uk
Is your business affected?
Selling into the UK without a UK establishment? Article 27 of the UK GDPR requires a UK representative — the named contact for the regulator and data subjects. We hold that seat.
If this touches how your organisation handles personal data, drop us a line. We’ll talk it through with you — no obligation.
