What’s changing?
As a result of reforms under the Data (Use and Access) Act 2025 (DUAA), the UK data protection regulator (the ICO) is being restructured from a corporation sole, where power is vested in the Information Commissioner, to a body corporate (the Information Commission).
The Information Commission will be led by a Board made up of a Chair, a Chief Executive Officer (CEO) and 7 non-executive directors. This structure will be broadly reflective of UK regulators such as the Financial Conduct Authority and the Competition and Markets Authority.
The expected benefits are to make the regulator more resilient and to increase the diversity of its strategic leadership.
Paul Arnold will be the first CEO of the future Information Commission. This role is described as an interim appointment for a maximum two-year period, after which a permanent recruitment process will be undertaken.
John Edwards, the current Information Commissioner, was expected to act as Chair of the Information Commission, until he completed his term at the end of 2026. However, on 26th February 2026 he announced that during the last few weeks he has voluntarily stepped aside pending an independent investigation into HR matters. Depending on the outcome of the investigation and any resulting decisions, this may create uncertainty around John Edwards’ future role.
When?
The Information Commission is expected to become operational later this year, subject to any delays resulting from John Edwards stepping aside.
What should we do?
- Update document templates: Plan to update references to the “ICO” and “Information Commissioner” to “Information Commission” across privacy notices and other relevant documentation. Where possible, use flexible definitions going forward to reduce future rework.
- Monitor the implementation timeline: Track announcements from the ICO on when the Information Commission will become operational, and link this to internal change control (for example, set a reminder to update templates).
- Monitor leadership changes: Keep track of updates on the ICO’s interim leadership arrangements and any announcements about the HR investigation impacting on John Edwards, as this could affect how quickly the new governance model is established.
- Monitor governance and strategic priorities: Watch for information and guidance on how the Information Commission intends to govern (including Board approach and decision-making) and for updates on its strategic priorities, to anticipate any shifts in regulatory focus and enforcement.
- Train key teams on the change: Brief privacy, legal, compliance, customer support, and incident-response teams so they use the new name consistently in communications and documentation after implementation.
