Information Commission succeeds the ICO as UK's data protection regulator
From today, the new Information Commission takes over the ICO’s functions, modernising the regulator’s governance while maintaining its independent oversight and existing powers to protect people’s personal data.
People will continue to benefit from strong, independent oversight of how their personal data is used as the new Information Commission takes over from the Information Commissioner’s Office (ICO) today, 30 September.
The change marks a significant modernisation of the UK’s data protection regulator. The ICO has operated as a corporation sole, with all statutory powers and responsibilities vested in the Information Commissioner. From today, those functions transfer to the Information Commission, a body corporate led by executive and non-executive members with collective responsibility for decisions.
The new Commission will continue to oversee how organisations use and protect people’s personal data, helping to ensure it is handled responsibly.
Digital Government Minister Stephanie Peacock said:
People should have confidence that their personal information is being used responsibly, whether they are accessing public services, shopping online or using new digital technologies.
The new Information Commission will continue to provide strong, independent oversight of data protection, while bringing together a range of expertise to ensure the regulator remains equipped to respond to future challenges and opportunities in a fast-changing digital world.
The new governance model was established in the Data (Use and Access) Act 2025, which received Royal Assent in June 2025. It brings together executive and non-executive members with collective responsibility for decisions and helps ensure the organisation remains well placed to respond to rapid technological change, increasingly complex uses of data and evolving public expectations around transparency and accountability.
For individuals and organisations, the transition does not change the regulator’s role, responsibilities, or powers. It will continue to regulate data protection and freedom of information legislation independently.
The Commission will be led by the interim Chief Executive, Paul Arnold, alongside seven newly appointed non-executive members.
Paul Arnold, Chief Executive Officer of the Information Commission, said:
I’m delighted to be able to formally welcome our non-executive board members and Deputy Chair. Their appointments mark a further key milestone in our modernisation and transformation as a regulator.
Today is the beginning of an important new chapter for our organisation. As the Information Commission, we are building on more than four decades of experience while strengthening how we are governed and led.
The day-to-day work that people rely on from us continues. We will continue to provide organisations with the guidance and certainty they need, support responsible innovation, and hold organisations to account when people’s information rights are not respected.
Notes to Editors
- Recruitment for a new Chair of the Information Commission is ongoing.
- The new Non-Executive members are Laurie Benson, Maggie Carver, Stephen Cohen, Sukhvinder Kaur-Stubbs, Gary Kildare, Hilary Newiss and Scott McPherson.