Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

ICO to become Information Commission by 30 September 2026

30 September 2026

30 September 2026 marks the deadline for the ICO to transition into the Information Commission, as mandated by the Data (Use and Access) Act 2025. This significant organisational change requires substantial preparatory work within the existing regulator before the date arrives.

The Data (Use and Access) Act 2025 stipulates a complete rebranding and restructuring of the Information Commissioner's Office into the Information Commission by the specified date. This transformation involves not only a name change but also a reevaluation of internal governance structures, necessitating a comprehensive programme of work for the current ICO leadership.

Organisations should anticipate updated guidance and communications from the newly formed Information Commission, particularly regarding its operational procedures and any revised expectations for data controllers and processors. Evidence of this preparatory work would include updated charters, revised internal policies, and a clear communication strategy for stakeholders, demonstrating a smooth transition of regulatory functions.

While the regulatory functions themselves are expected to remain consistent, the shift in organisational identity and potentially its internal operational framework requires diligent planning and execution. Data protection officers and privacy counsel should monitor official announcements for details on how this change will be communicated and implemented.

Data (Use and Access) Act 2025 sets 30 September 2026 as the point of effect, and the preparation it requires sits with teams who are measured on other work, which is why this date slips rather than the obligation being misread.

Data (Use and Access) Act 2025

Who this binds
The ICO
What changed
What is fixed is the date the obligation begins to apply: 30 September 2026, when the ICO will officially transition to the Information Commission, with a new governance structure and board taking effect.
What to check
Be aware of the change in the regulatory body's name and governance structure, though regulatory functions remain the same.
What this does not mean
This is a date in the diary, not a new obligation published today. Nothing in force changed this morning.

Send this to your team

The ICO must complete its transition to the Information Commission by 30 September 2026, as required by the Data (Use and Access) Act 2025.

Today's question

A DPO is reviewing the impact of the Data (Use and Access) Act 2025. What is the latest date by which the ICO is mandated to transition into the Information Commission?

  1. 30 September 2026
  2. 30 September 2025
  3. 1 January 2026
  4. 1 January 2025

Answer this question on the site

Worth knowing

  1. New Zealand Privacy Commissioner sets expectations for smart glasses use

    Organisations considering or implementing smart glasses technology must consult the New Zealand Privacy Commissioner's guidance to ensure compliance with privacy principles, especially regarding transparency and data minimisation.

  2. Brazilian ANPD finds half of adult content platforms fail age verification

    Brazilian privacy professionals should note the ANPD's focus on age verification for adult content platforms, signalling potential enforcement actions against services failing to protect minors.

  3. Truyo launches warranty for privacy compliance and AI governance platforms

    Organisations evaluating privacy technology vendors should consider how Truyo's new warranty program could mitigate financial risks associated with privacy compliance and AI governance platform failures.

  4. FTC rescinds 2021 policy statement on health app data breaches

    US health privacy professionals should review the implications of the FTC's rescission of its 2021 policy statement, as it may signal a shift in the regulator's approach to health app data breach enforcement.

  5. Kenya issues new guidance on cross border data transfers

    Organisations operating in Kenya must familiarise themselves with the ODPC's new Guidance Notes for Cross border Data Transfers to ensure their international data flows remain compliant with local regulations.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.