The UK’s data protection and freedom of information regulator has formally transitioned from the Information Commissioner’s Office (ICO) to the Information Commission under the Data (Use and Access) Act 2025.
This change introduces a new governance structure, with the regulator now operating as a corporate body led collectively by executive and non-executive members, replacing the previous model where statutory responsibilities rested with an individual Information Commissioner.
What Does This Mean for Organisations?
The regulator’s powers, responsibilities, independence and enforcement activities remain unchanged, and it will continue to operate publicly under the familiar ICO branding. There are currently no changes required to existing data protection compliance programmes, policies or operational practices.
However, organisations should be aware that formal references to the regulator in legal and governance documentation may need updating to reflect its new statutory name, where accuracy is required.
Recommended Actions
Organisations should:
- Review privacy notices, policies, procedures to refer to the Information Commission where appropriate.
- Brief relevant compliance, legal and privacy stakeholders on the change.
- Continue to monitor developments arising from the wider implementation of the Data (Use and Access) Act 2025.
- Contact your Tiaa DPO for further advice.