ICO Data Protection Register

Is the ICO still the ICO? What the Information Commission means for you

No. As at 31 July 2026 the Information Commissioner's Office is still the regulator, because the two provisions that abolish the Commissioner and hand functions to the new Information Commission are not in force. Your obligations are unchanged, and you do not need to rewrite documents that say 'Information Commissioner'.

Last updated 31 July 2026. This page explains the law as it stands on that date. It is general information, not legal advice.

The bottom line

The ICO has not been replaced. The Information Commission exists on paper but has no functions yet. Your legal obligations have not changed, and no document needs rewriting for the name. There is a real privacy notice change this year, but it is a different one: since 19 June 2026 you must tell people they can complain to you as well as to the regulator.

No — the ICO has not been replaced yet

On 31 July 2026 the UK's data protection regulator is still the Information Commissioner's Office. The Information Commission does exist: it was created as a body corporate on 20 August 2025 by section 117 of the Data (Use and Access) Act 2025, which inserted a new section 114A into the Data Protection Act 2018. It has not been given any functions.

The two provisions that do the actual handover are not in force. Section 118 abolishes the office of Information Commissioner. Section 119 transfers the Commissioner's functions to the Commission and provides that references to the "Information Commissioner" in any enactment or document are to be read as references to the "Information Commission". legislation.gov.uk records both as prospective — not in force. And section 114 of the DPA 2018 — "There is to continue to be an Information Commissioner" — is unrepealed and still in force.

Provision What it does Status at 31 July 2026
DUAA s.117 (except s.117(4)(a)) Creates the Information Commission as a body corporate In force 20 August 2025 (SI 2025/904 reg. 2(r))
DUAA s.120 Power for the Secretary of State to make a scheme transferring property, rights and liabilities In force 5 February 2026 (SI 2026/82 reg. 2(z1))
DUAA s.118 Abolishes the office of Information Commissioner; repeals DPA 2018 s.114 Not in force
DUAA s.119 Transfers functions; renames references in legislation Not in force
SI 2026/386 Consequential renaming of "Commissioner" to "Commission" across other legislation Made 26 March 2026; comes into force only when s.119 is fully in force

A conflict worth knowing about

An ICO news item marking the 12-month commencement on 19 June 2026 states that "all outstanding provisions of the Act are now in force". That is accurate for the data protection provisions in Part 5 of the DUAA. It is not accurate for Part 6, where sections 118 and 119 sit. Where a press release and the statute disagree, rely on legislation.gov.uk.

Who is in charge right now

John Edwards voluntarily stepped back from his duties on 26 February 2026 so that an independent workplace investigation could take place. The investigation concluded on 10 June 2026 that there was a case to answer, and he resigned on 19 June 2026, submitting his resignation to the Department for Science, Innovation and Technology (DSIT).

The DPA 2018 already deals with this. Schedule 12, paragraph 6 provides that if there is a vacancy in the office of the Commissioner, or the Commissioner is for any reason unable to act, the Commissioner's functions are carried out by the deputy commissioner or deputy commissioners. On 11 June 2026 the ICO announced that Deputy Commissioner and Chief Executive Paul Arnold would take on the Commissioner's non-delegable responsibilities under the ICO's Scheme of Delegation, and that DSIT had designated him Temporary Acting Accounting Officer.

The Commission's board is being assembled in parallel. Mr Arnold was named interim Chief Executive of the future Information Commission on 30 June 2025, with Mr Edwards announced at the same time as its chair. On 15 July 2026 DSIT announced seven Non-Executive Members — Laurie Benson, Maggie Carver, Stephen Cohen, Sukhvinder Kaur-Stubbs, Gary Kildare, Hilary Newiss and Scott McPherson — on three-year terms, and launched a fresh recruitment campaign for the Chair, with applications closing 19 August 2026.

Who signs enforcement notices, and is enforcement still happening?

Enforcement notices and penalty notices are issued under sections 149 and 155 of the DPA 2018 by the Commissioner. Because section 119 is not in force, they are still issued in the name of the Information Commissioner, and Schedule 12 paragraph 6 puts those functions in the hands of the deputy commissioners while the office is vacant. A vacancy does not suspend the ICO's powers.

The ICO has continued to announce enforcement action, and to take new investigative steps, since the resignation:

Your open complaint, investigation or fee registration

Nothing is lost in the changeover. Section 120 of the DUAA, in force since 5 February 2026, lets the Secretary of State make a scheme transferring property, rights and liabilities from the Commissioner to the Commission — including ongoing legal proceedings — and allows the Commission to continue work started by the Commissioner. Functions, staff, records and live casework move together. Until section 119 commences, your case stays with the ICO exactly as it is, handled by the same people.

Registration is unaffected. You still register with the ICO and pay your data protection fee under the Data Protection (Charges and Information) Regulations 2018. The amounts are unchanged: £52 (tier 1), £78 (tier 2) and £3,763 (tier 3), each reduced by £5 if you pay by direct debit. Those figures have applied since 17 February 2025, when SI 2025/63 came into force — if you see £40, £60 or £2,900 quoted anywhere, that source is out of date.

Do you need to rewrite everything that says 'Information Commissioner'?

No, and there is no deadline that requires it. Section 119, when it commences, does the renaming in legislation for you. The consequential instrument, SI 2026/386, was made on 26 March 2026 but comes into force only when section 119 is fully in force, and its amendments are still marked as not yet applied.

  1. Step 1 Leave the name alone for now Documents referring to the Information Commissioner or the ICO are currently correct. Changing them today would make them wrong, because the Commission has no functions.
  2. Step 2 Fold it into routine refreshes Add the name change to your normal review cycle for privacy notices, contracts, complaints procedures and staff guidance. Wholesale revision now is wasted effort.
  3. Step 3 Watch for the commencement regulations The trigger is a commencement statutory instrument bringing sections 118 and 119 into force. DSIT says the Commission will take over "later this year". No date has been set.
  4. Step 4 Keep the practical details working ico.org.uk, the ICO helpline and the ICO's complaint and registration routes continue to operate. Check any web addresses you cite still resolve when the changeover happens.

What you should be updating in your privacy notice in 2026

There is a genuine privacy notice change this year, and it has nothing to do with the regulator's name. Schedule 10 to the DUAA amended UK GDPR Articles 13 and 14 from 19 June 2026, adding a duty to tell people about the right to make a complaint to the controller under new section 164A of the DPA 2018, inserted by section 103. The ICO says you must tell people they can complain to you as well as to the regulator at the point you collect their personal information — for example in your privacy notice — and when you respond to a subject access request, where new Article 15(1)(ea) applies.

The underlying duty is to facilitate the making of complaints, acknowledge a complaint within 30 days beginning when it is received, take appropriate steps to respond, and tell the complainant the outcome without undue delay. The duties in section 164A(3) and (4) apply only to complaints received on or after 19 June 2026.

Note that the amended Articles 13 and 14 themselves still refer to making a complaint "to the Commissioner under section 165 of the 2018 Act". So the correct wording for a privacy notice today is still the Commissioner and the ICO. Two other 2026 changes are worth a look while you are in the document:

What has not changed

Still exactly as it was

The transition is a governance change. It does not change the law you have to follow.

  • The UK GDPR and the DPA 2018 were amended by the DUAA, not replaced or repealed.
  • You still register with the ICO and pay the same data protection fee, in the same tiers.
  • You still report qualifying personal data breaches to the regulator within 72 hours under Article 33.
  • You still need a data protection officer where Article 37 applies. There is no 'senior responsible individual' duty — that was a Data Protection and Digital Information Bill proposal that fell in 2024 and was not carried into the DUAA.
  • You still keep records of processing activities and carry out data protection impact assessments where required.
  • People can still complain to the Commissioner under section 165 of the DPA 2018, through the same ICO routes.
Read the ICO's guidance on the Data (Use and Access) Act 2025 open_in_new

Common questions

Has the ICO changed its name to the Information Commission?

Not yet. The Information Commission was created as a body corporate on 20 August 2025, but the provisions that abolish the office of Information Commissioner (DUAA s.118) and transfer functions to the Commission (s.119) are not in force as at 31 July 2026. Until they commence, the ICO remains the regulator and the correct name to use.

Who is the Information Commissioner now?

The office is vacant. John Edwards resigned on 19 June 2026. Under Schedule 12, paragraph 6 of the Data Protection Act 2018, the Commissioner's functions are carried out by the deputy commissioners during a vacancy. The ICO announced on 11 June 2026 that Deputy Commissioner and Chief Executive Paul Arnold would take on the non-delegable responsibilities, and that DSIT had designated him Temporary Acting Accounting Officer.

Do I need to change 'Information Commissioner's Office' to 'Information Commission' in my privacy notice?

No. There is no deadline and the change would be premature. When section 119 commences it will make references in legislation read as the Commission automatically. Update your own documents on your next routine review instead of running a separate rewrite project.

I have an open ICO complaint or investigation. Will it be lost or restarted?

No. Section 120 of the DUAA, in force since 5 February 2026, allows a transfer scheme covering property, rights, liabilities and ongoing proceedings, and allows the Commission to continue work started by the Commissioner. Until then your case sits with the ICO and is handled as normal.

Will my ICO registration or data protection fee change?

Not because of this. You still register with the ICO and pay the same fee: £52, £78 or £3,763 depending on tier, less £5 for direct debit. Those amounts have applied since 17 February 2025 under SI 2025/63 and no change is pending.

Is the ICO still issuing fines while the Commissioner post is vacant?

Yes. Since the resignation the ICO has announced a £300,000 fine against KRA Consultancy Ltd (23 June 2026) and fines totalling £370,000 against two home improvement companies (8 July 2026), and on 29 July 2026 it executed search warrants at premises linked to five companies in a car finance nuisance marketing investigation.

Sources

This page summarises the following primary sources. Where they disagree with this summary, they take precedence.

Related guidance