The ICO has been replaced. Your data rights have not changed
What happened
On 30 September 2026, the body that polices how organisations use your personal information changed its name and its shape. The Information Commissioner's Office, known to almost everyone as the ICO, handed its functions to a new body called the Information Commission. The difference is in how the organisation is run. The ICO was what lawyers call a corporation sole. In practice that means every legal power and responsibility sat with one person: the Information Commissioner. From 30 September, those powers belong to the Information Commission instead. It is a body corporate, led by executive and non-executive members who take decisions together. The new set-up was created by the Data (Use and Access) Act 2025, which became law in June 2025. The Commission is being led by an interim Chief Executive, Paul Arnold, alongside seven newly appointed non-executive members: Laurie Benson, Maggie Carver, Stephen Cohen, Sukhvinder Kaur-Stubbs, Gary Kildare, Hilary Newiss and Scott McPherson. Recruitment for a permanent Chair is still under way. The government was clear about what has not changed. Digital Government Minister Stephanie Peacock said the new Commission 'will continue to provide strong, independent oversight of data protection'. The official announcement states that for individuals and organisations, the transition does not change the regulator's role, responsibilities or powers. Paul Arnold said the day marked 'the beginning of an important new chapter', while stressing that 'the day-to-day work that people rely on from us continues'.
Why this matters
This sounds like paperwork, and in one sense it is. But the regulator in question is the one you turn to when something goes wrong with your personal information. It is the body that handles complaints when a company will not tell you what data it holds on you. It is the body that investigates when an organisation loses or leaks records. It is the body that oversees freedom of information requests to public authorities. And it is the body that can fine organisations that get it badly wrong. That matters a great deal in health. Prescription records, GP notes, test results and delivery addresses are among the most sensitive information about any of us. On 26 September 2026 we reported that NHS trusts had been told to suspend staff who snoop on patient records, with more than 200 sacked in five years. The regulator behind that kind of enforcement is the one that has just changed form. The practical reason to care is simple. If you ever need to complain, you need to know who to complain to. The answer is now the Information Commission, and the ico.org.uk website and existing contact routes continue to operate.
What the evidence actually says
It is worth separating what is documented from what is hoped for. What is documented: the legal change, the names of the new members, and the statement that powers and responsibilities are unchanged. All of that is set out in the government announcement and in the Data (Use and Access) Act 2025. The argument for the change is about governance. Under a corporation sole, a single person holds every statutory power. The government's case is that decisions of this weight are better taken by a group that brings together different expertise, with collective responsibility, in a field moving as quickly as data and artificial intelligence. That is a reasonable argument, and it mirrors how most other UK regulators are already built. What has not been demonstrated yet is the effect. Shared decision-making can mean broader expertise and fewer blind spots. It can also mean slower decisions. Which of those the Information Commission delivers will show up in things that can actually be measured: how long complaints take, how many enforcement actions are taken, and how clear its guidance is. The Commission says it will continue to provide guidance and certainty to organisations, support responsible innovation, and hold organisations to account when people's information rights are not respected. That is a fair test to hold it to, and the first year of casework will be the evidence. One more honest note: a leadership change mid-transition is a real variable. The Commission currently has an interim Chief Executive and no permanent Chair.
Practical advice
Here is what to do if you ever need to use your data rights. You can ask any organisation what personal information it holds about you. This is a subject access request. You do not need a solicitor and it is normally free. A plain email asking for a copy of your personal data is enough. The organisation usually has one month to respond. If you think data about you is wrong, you can ask for it to be corrected. If you think it should no longer be held, you can ask for it to be deleted, although there are exceptions, and medical records are one area where organisations have a legal duty to keep records for set periods. Always complain to the organisation first. Most problems are resolved at that stage, and the regulator will usually expect you to have tried. If you are not satisfied, you can complain to the Information Commission. Its website and helpline continue to operate at ico.org.uk during the transition. Keep a written record. Dates, who you spoke to, and copies of emails make any later complaint far easier. If you receive a letter saying your data was involved in a breach, read what it tells you to do, be alert to follow-up scam calls and emails referring to that breach, and never share passwords or bank details with someone who contacts you out of the blue.
What to know
From 30 September 2026 the Information Commission replaced the Information Commissioner's Office as the UK's data protection and freedom of information regulator. The change was created by the Data (Use and Access) Act 2025 and moves power from one individual to a board of executive and non-executive members. The regulator's role, responsibilities and powers are unchanged, and so are your rights: you can still ask what data is held about you, ask for corrections, and complain. Paul Arnold is interim Chief Executive, seven non-executive members have been appointed, and a permanent Chair is still being recruited. Nothing you need to do changes today. The name on the letterhead does. Sources: GOV.UK (Department for Digital, Culture, Media and Sport), 'Information Commission succeeds the ICO as UK's data protection regulator', 30 September 2026, https://www.gov.uk/government/news/information-commission-succeeds-the-ico-as-uks-data-protection-regulator; legislation.gov.uk, 'Data (Use and Access) Act 2025', June 2025, https://www.legislation.gov.uk/ukpga/2025/18/contents; Information Commissioner's Office, 'About the ICO', https://ico.org.uk/about-the-ico/. This article is for general information and does not replace advice from a doctor, pharmacist or other qualified healthcare professional.
Related articles
Four months early: 3,880 rural premises and an £8.2 million contract
On 13 October 2026, the government announced that a rural broadband project in North Oxfordshire had finished four months ahead of schedule. The work connected…
First hearing from a police cell: £17.4 million and four force areas
On 12 October 2026, the Ministry of Justice published the government's response to Lord Leveson's review of the criminal courts. The review made 180 recommendat…
Over 1,000 weak spots found, and a minister's message to AI firms
On Monday 12 October 2026, the UK government set out a package of measures aimed at protecting the country from increasingly powerful artificial intelligence.…