UK Shifts Privacy Power to Board-Led Information Commission
The UK replaced the ICO with the board-led Information Commission, moving HQ to Manchester.
Why it matters: This restructure changes how UK data privacy is governed, impacting compliance and enforcement for firms operating there. Legal teams must adjust to collective decision-making and new leadership.
- On September 30, 2026, the ICO became the Information Commission, governed by a board.
- The change follows the Data (Use and Access) Act 2025, passed in June 2025.
- Information Commission's HQ is now in Manchester, marking regional focus.
- Seven non-executive board members appointed; Chair recruitment ongoing; Paul Arnold is interim CEO.
On September 30, 2026, the UK’s Information Commissioner’s Office (ICO) transitioned to the Information Commission, a new corporate body designed to modernize data protection regulation.
The change was mandated by the Data (Use and Access) Act 2025, which received Royal Assent in June 2025. This law shifted statutory privacy powers from a single Information Commissioner to a collective board structure.
The Information Commission is now governed by a board made up of seven non-executive members: Laurie Benson, Maggie Carver, Stephen Cohen, Sukhvinder Kaur-Stubbs, Gary Kildare, Hilary Newiss, and Scott McPherson. Recruitment for a permanent Chair is underway. Meanwhile, Paul Arnold serves as interim Chief Executive Officer.
The headquarters have relocated from London to Manchester, signaling a commitment to regional engagement and accessibility. According to ICO statements, this move marks a new chapter building on more than 40 years of data protection experience.
Digital Government Minister Stephanie Peacock emphasized that “people should have confidence that their personal information is being used responsibly,” recognizing the growing importance of trustworthy data use across public services, commerce, and technology.
For legal teams and compliance officers, the shift to a collective governance model means adjusting strategies around regulatory engagement and enforcement expectations under the Information Commission.
By the numbers:
- 30 September 2026 — ICO became Information Commission
- 7 — Non-executive members appointed to the Board
- June 2025 — Data (Use and Access) Act received Royal Assent
What's next: Recruitment continues for a permanent Chair of the Information Commission, expected to define strategic direction.