Information Commission Name Change Explained Simply

On 30 September, the UK’s data protection regulator changed its name. The Information Commissioner’s Office – the ICO – became the Information Commission.

If that sentence meant nothing to you, stay with me, because the thing it refers to affects every organisation that holds personal data, including yours. And if it meant something and gave you a small sinking feeling about what you now have to do, I can save you the worry: for almost everyone, the answer is very little. But it is worth understanding what has changed, because it is easy to misread in both directions – as either nothing at all, or far more than it is.

Start with what the ICO was, since not everyone has had reason to meet it.

The Information Commissioner’s Office was the UK’s independent regulator for data protection. In plain terms, the body that makes sure organisations handle people’s personal data properly. It enforces the law – UK GDPR and the Data Protection Act – takes complaints from people who think their data has been mishandled, investigates breaches, and has the power to issue fines when things go badly wrong. If your institution has ever reported a data breach, trained staff on data protection, or worried about the consequences of getting it wrong, the ICO is the body on the other end of all of that. It is the reason “we’ll have the ICO on us” is a sentence that makes people sit up in a meeting.

What happened on 30 September is a change to how that regulator is built, not to what it does.

Until now, the ICO was structured around a single person: the Information Commissioner, one individual in whom all the legal powers and responsibilities were formally vested (most recently John Edwards). It is an unusual way to run a regulator, and a rare one now.

Meet the Information Commission

The Information Commission replaces that with a board. Instead of one person holding all the authority, there is a chair, a chief executive and a group of members who share responsibility for decisions – the model already used by Ofcom and other UK regulators. The change comes from the Data (Use and Access) Act 2025, the same law behind several of this year’s data protection shifts. Day to day, it will still be referred to as the ICO, which tells you how much of this is about the plumbing rather than the service.

Here is the part that matters most for you, and the part the headlines tend to bury.

None of your obligations have changed. The rules you follow are the same rules. Breach reporting still runs to the same 72-hour timeline. Subject access requests carry the same deadlines. People’s rights over their data, and the way they exercise them, are untouched. The enforcement powers carried over intact. If you were compliant on 29 September, you are compliant on the 30th, and nobody needs to redo a single process because of this. It is a change to the regulator’s wiring, not to the law it enforces or the duties you have under it.

There is one small, useful job that comes out of it, though.

Somewhere in your organisation, the letters “ICO” sit in documents. Your privacy notices. Your data protection policy. The staff training that tells people how to report a breach. Contracts and data processing agreements that name the ICO as the relevant supervisory authority. None of those are wrong today – the law carries the references across – but they are now out of date, and exactly the kind of detail that gets picked up at an awkward moment: a due diligence check, a supplier audit, an OfS data review a year from now. So the response is neither to panic nor to ignore it. Make a note to update those references the next time each document is reviewed. A find-and-replace job, not a project.

And there is a second, more useful prompt hidden in here.

If the thought of hunting down every mention of the ICO fills you with dread because you are not sure those documents have been looked at properly in years, that, rather than the name change, is the thing worth your attention. A regulator renaming itself is as good a reason as any to check when your privacy notices and policies were last reviewed, and whether they still describe what your institution does. For a lot of providers the honest answer is “longer than we’d like”, and the name change is a harmless nudge to fix it.

The ICO becoming the Information Commission is, in itself, not much. But if it sends you back to documents you have not opened since you wrote them, it will have done you more good than its authors intended.