The ICO: What the UK Data Protection Regulator Does 

Update: October 2026

The Information Commissioner’s Office (ICO) is the UK’s independent regulator for data protection and information rights. On 30 September 2026, its legal structure changed: the Information Commission took over all the functions of the Information Commissioner’s Office under the Data (Use and Access) Act 2025.

This guide covers what the regulator does, its powers, the data protection fee, how complaints work, and what the structural change means for organisations.

Key Takeaways

• From 30 September 2026, the Information Commission took over all functions of the ICO. The ICO operated as a corporation sole, with a single Information Commissioner holding the powers. The Commission is a body corporate with executive and non-executive members, and it is collectively responsible for decisions. Its regulatory functions are unchanged.

• The regulator can use assessment notices, warnings, reprimands, enforcement notices and penalty notices. The Data (Use and Access) Act added powers such as compelling a witness to attend an interview and requesting reports from approved persons.

• Organisations that use personal information must pay the data protection fee unless exempt. Every organisation must also have a process for handling data protection complaints, with no exemptions. It must acknowledge each complaint within 30 days and respond without undue delay.

The Regulator Upholds Information Rights in the UK

The ICO is the UK’s independent supervisory authority for data protection. Its remit covers the UK GDPR and the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), freedom of information and environmental information rules.

Its work includes publishing guidance, advising and supporting organisations, handling complaints, conducting audits, and taking enforcement action. The European Commission renewed its adequacy decisions for the UK on 19 December 2025, valid until 27 December 2031. Our guide to data protection after the UK left the EU explains the wider framework.

The ICO Became the Information Commission on 30 September 2026

The Data (Use and Access) Act 2025 changed the regulator’s governance. The government’s written statement of 14 September 2026 says the Information Commission will take over all the ICO’s functions and responsibilities on 30 September 2026. The government made regulations to give effect to the transition: the Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026.

The ICO had been a corporation sole, with its powers vested in one person. The Commission is a body corporate with non-executive and executive members, and it makes decisions collectively. The government named seven non-executive members, and Paul Arnold is the interim Chief Executive. The government launched a public appointments campaign to recruit the Commission’s Chair.

The ICO’s announcement says the change maintains existing regulatory functions and responsibilities, with a focus on continuity of service. For most organisations, the practical effect is limited. The rules you follow and the guidance you use remain in place, and the ICO’s published guidance remains the reference point. The regulations also state that anything done by or in relation to the Information Commissioner, including ongoing legal proceedings, is treated as done by or in relation to the Information Commissioner. Check documents that name the Information Commissioner, such as privacy notices and contracts, and update the reference the next time you revise them.

Enforcement Powers Cover Notices and Penalties

The ICO’s enforcement page for the Children’s Code lists the tools it holds for GDPR and PECR breaches: assessment notices, warnings, reprimands, enforcement notices and penalty notices. Its approach is risk-based, with its strongest powers aimed at repeated or wilful misconduct and serious failures to protect personal data.

The Data (Use and Access) Act added powers. The ICO’s summary says they include the ability to compel a witness to attend an interview and to request reports from approved persons. The ICO published draft enforcement procedural guidance on how it will carry out investigations and take enforcement action, and said the law has commenced and the powers can be used in the most serious cases.

The Act also gave the regulator new statutory objectives, which have been in force since 20 August 2025.

Every Organisation Using Personal Data Must Pay the Fee Unless Exempt

Under the Data Protection (Charges and Information) Regulations 2018, organisations, including sole traders, that use personal information must pay a data protection fee to the ICO unless they are exempt. The fee replaced the previous requirement to notify the ICO under the Data Protection Act 1998.

The ICO’s data protection fee page explains who must pay and how to register. Keep the registration current when your details change.

Organisations Must Have a Data Protection Complaints Process

The complaints provision of the Data (Use and Access) Act came into force on 19 June 2026. The ICO’s guidance says you must have a process for handling data protection complaints within your organisation, and that there are no exemptions. You must give people a way to complain, acknowledge it within 30 days, take appropriate steps to respond without undue delay, keep people informed, and tell them the outcome without undue delay. The ICO provides an electronic complaints form as an example of how people can complain.

The ICO’s guidance on handling data protection complaints sets out the required process. For subject access requests, see our guide to responding to a subject access request.

The Act’s Other Changes Shape How the Regulator Works

The ICO states that all data protection provisions in the Data (Use and Access) Act 2025 are now in force. Most data protection changes took effect on 5 February 2026. They include a new recognised legitimate interests lawful basis, reasonable and proportionate searches for subject access requests, changes to automated decision-making rules and exemptions from consent for some cookies.

The regulator is updating its guidance to match, and its consent guidance, for example, was revised in August 2026. See our guide to valid consent under GDPR for the current position. The ICO publishes a list of guidance it is working on, which you should check before relying on an older page.

A Short Checklist Covers the Basics

Confirm your data protection fee is paid and your details are up to date. Put a complaints process in place and test it against the 30-day acknowledgement. Review privacy notices and contracts for references to the Information Commissioner. Check that guidance you rely on carries a recent update date, since many ICO pages changed in 2026.

Organisations outside the UK that are subject to the UK GDPR may need a UK representative under Article 27. GDPRLocal offers UK representative and GDPR consultancy services for fee registration, complaints procedures, and documentation reviews.

Conclusion

The regulator has a new legal form and the same job. The Information Commission now performs the ICO’s functions, with a board that shares decisions, and its powers, guidance, and expectations for organisations continue.

The actions for organisations are practical: pay the fee, run a complaints process, keep documents accurate and watch for updated guidance as the regulator brings its pages in line with the Data (Use and Access) Act.

Frequently Asked Questions

Is the ICO Now the Information Commission?

Yes. On 30 September 2026, the Information Commission took over all the functions of the Information Commissioner’s Office under the Data (Use and Access) Act 2025. The government’s statement describes it as the UK’s independent data protection regulator, and the ICO says it will continue to carry out its existing regulatory functions and responsibilities.

Do We Still Have to Pay the Data Protection Fee?

Yes, unless you are exempt. Organisations, including sole traders, that use personal information must pay the fee under the Data Protection (Charges and Information) Regulations 2018. The ICO’s fee page explains who must pay and how.

Does Our Organisation Need a Data Protection Complaints Process?

Yes. The ICO’s guidance says every organisation must have a process for handling data protection complaints, with no exemptions. You must give people a way to complain, acknowledge complaints within 30 days and respond without undue delay.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.