From 30 September 2026, the UK’s data protection regulator enters a new era. Under the Data (Use and Access) Act 2025 (DUAA), the office of the Information Commissioner will be replaced by the Information Commission, overseen by a board-led governance structure. However, organisations are expected to continue referring to the regulator as the ICO (Information Commission Office) in practice.
While this is a significant constitutional change for the regulator, businesses should be reassured that it does not introduce new data protection obligations. Existing UK GDPR, PECR and data protection requirements remain unchanged. Instead, the transition marks a shift in how the regulator is governed and how it will prioritise its regulatory activity in the coming years.
Why Is the ICO Changing?
The DUAA established the framework for replacing the single Information Commissioner model with a board-led Information Commission. The intention is to create a more modern governance structure capable of addressing increasingly complex issues such as artificial intelligence, cyber resilience and children’s online privacy.
The Government has already appointed a number of non-executive directors to help oversee the new organisation, signalling a move towards broader strategic leadership and accountability within the UK’s privacy regulator.
Importantly, all existing regulatory functions, investigations, complaints and enforcement activities will continue uninterrupted after 30 September. Organisations do not need to take any specific action beyond ensuring future references in governance documentation remain accurate.
The Information Commission’s Strategic Priorities
Alongside the organisational transition, the regulator has published a draft strategy outlining where it intends to focus its resources over the coming years. The strategy centres on four key themes.
Protecting Children’s Personal Data
Children’s privacy remains one of the regulator’s highest priorities. Building upon the Children’s Code (Age Appropriate Design Code), the regulator intends to continue driving improvements in social media, gaming, educational technology and other online services accessed by children. The focus remains on ensuring privacy and safety are embedded by design and default.
Recent regulatory action demonstrates that organisations processing children’s personal data can expect continued scrutiny, particularly where age assurance, profiling, behavioural advertising or online engagement tools are involved.
Enabling Responsible AI Innovation
The Information Commission recognises that artificial intelligence offers significant opportunities for economic growth and innovation. However, it also wants organisations to use personal data responsibly when training, deploying and operating AI systems.
The regulator has indicated it will continue helping organisations understand how data protection principles apply to AI, providing greater clarity around transparency, lawful processing, accountability and governance requirements.
For businesses adopting AI technologies, compliance is increasingly being framed as a business enabler rather than simply a regulatory obligation.
Building Public Trust in Data Use
Public trust remains a significant challenge for organisations that collect and process personal data. The regulator has highlighted concerns around confidence in how both public and private sector organisations use personal information. As a result, transparency, fairness and accountability are likely to remain key enforcement themes.
Organisations should expect increased focus on:
- Clear privacy information
- Data sharing arrangements
- Ethical decision-making
- Demonstrable accountability
- Governance frameworks that can evidence compliance activities
These are all areas where organisations must be able to demonstrate not only compliance, but also responsible stewardship of personal data.
Strengthening Cyber Resilience
Cyber security continues to be one of the most pressing risks facing UK organisations. With cyber-attacks, ransomware incidents and large-scale personal data breaches continuing to make headlines, the regulator has confirmed that improving cyber resilience will remain a strategic priority.
Businesses should expect continued attention on:
- Technical and organisational security measures
- Third-party supplier risk management
- Data breach response
- Incident reporting procedures
- Security governance and oversight
The message is quite clear – effective information security is now a core component of data protection compliance.
What Does This Mean for Businesses?
From our perspective at Privacy Helper, the regulator’s strategy provides a clear indication of where regulatory scrutiny is heading. The common theme running through all four priorities is proactive governance.
The Information Commission is signalling that organisations will increasingly be expected to:
- Demonstrate accountability rather than simply claim compliance.
- Embed privacy by design into products, services and projects.
- Conduct meaningful risk assessments for AI and emerging technologies.
- Take a proactive approach to children’s data protection.
- Strengthen cyber resilience and incident preparedness.
- Build public trust through transparency and responsible data use.
In short, organisations that wait until a complaint, breach or investigation occurs before focusing on compliance are likely to find themselves on the wrong side of regulatory expectations.
How Privacy Helper Can Help
As these strategic priorities take shape, many organisations will need practical support translating regulatory expectations into day-to-day business processes.
Privacy Helper can assist through:
AI Governance and Compliance
- AI governance frameworks
- AI DPIAs and risk assessments
- UK GDPR compliance reviews for AI solutions
- Automated decision-making assessments
- AI awareness training
Children’s Privacy Compliance
- Children’s Code compliance reviews
- Website and application assessments
- Privacy-by-design workshops
- Age assurance governance reviews
Data Protection Governance
- DPO and outsourced privacy support
- Data protection audits
- Accountability framework development
- Data sharing agreement reviews
- RoPA creation and maintenance
Cyber and Breach Preparedness
- Data breach response plans
- Incident management procedures
- Security governance assessments
- Supplier due diligence reviews
Conclusion
The transition from the Information Commissioner to the Information Commission is not a major compliance event for most organisations. However, it provides an important insight into the future direction of UK privacy regulation. The new board-led regulator has made its priorities clear: children’s privacy, responsible AI, public trust and cyber resilience. Organisations that invest now in strong governance, transparent decision-making and demonstrable accountability will be best placed to meet these expectations.
At Privacy Helper, we view this as a positive development. Effective data protection is no longer just about avoiding fines. It is about building trust, enabling innovation and creating resilient organisations that can thrive in an increasingly data-driven economy. Businesses that treat privacy as a strategic advantage, rather than a compliance burden, will be the organisations best positioned for long-term success.
