What Law Firms Need to Know About ICO Governance Changes  

On 30 September 2026, the Information Commissioner’s Office will formally become the Information Commission. The change is made under the Data (Use and Access) Act 2025 and marks a shift from the current model, in which statutory powers rest with a single Information Commissioner, to a board-led corporate structure with collective responsibility for its decisions.

For law firms, there is no immediate disruption. UK GDPR, the Data Protection Act 2018, and the regulator’s existing functions all continue to apply, and you can read some of our previous guides for recent changes under those obligations here:

• Does Your Law Firm’s Contact Form Comply with the New DUAA Marketing Rules?
• Is Your Website and Complaint Procedure Compliant with the New DUAA Rules?, 

Existing investigations and enforcement activity carry across automatically under statutory continuity provisions. Anything done by or in relation to the Information Commissioner is treated as having been done by or in relation to the Information Commission, including legal proceedings.

One point that saves some confusion: the ICO is not really disappearing. The regulator has confirmed that, as the Information Commission’s Office, it will continue to be known as the ICO. Firms should expect to see “ICO” on regulatory guidance, communications, and correspondence after 30 September, exactly as before.

Read the full announcement here: ICO governance changes confirmed for 30 September 2026

Why Are the Changes Being Made?

The move to a board-led structure is part of a wider set of reforms under the Data (Use and Access) Act 2025 designed to strengthen the regulator’s governance, transparency, and accountability.

Until now, the ICO has operated as a “corporation sole”, meaning its statutory powers were vested in one office-holder, the Information Commissioner. The new Information Commission will have a corporate board of between three and 14 members, including a chair, non-executive members, a chief executive, and potentially additional executive members. Non-executive members must, so far as practicable, outnumber executive members. The chair will continue to hold the title of Information Commissioner.

The former Information Commissioner, John Edwards, resigned in June 2026 following an independent workplace investigation. His departure did not prompt the structural change, which had already been established by the Act, but it did affect the leadership of the new body, as Edwards had been expected to become its chair. The government has launched a recruitment process for a new chair.

What Law Firms Should Do

Firms do not need to immediately panic that a new deadline is looming, but a certain level of housekeeping is required. The statutory continuity provisions mean existing references to the Information Commissioner in legislation, contracts, and policies are treated as references to the Information Commission where appropriate. There is no deadline for rewriting documentation, and the regulator has been clear that the ICO name is staying.

There is, however, some sensible maintenance to implement when your policies and client-facing documents next come up for review:

• Privacy notices. Most law firm privacy notices explain a client’s right to complain to the regulator and name the “Information Commissioner’s Office”. That reference could become “Information Commission’s Office (ICO)” at the next review. References that simply say “ICO” need no change at all.
• Client care letters. Where your client care documentation references the ICO as part of the firm’s data protection statement, the same applies. Update the full name when the letter is next revised.
• Data protection policies. Internal and external data protection policies that reference the Information Commissioner by full title are worth updating in the same cycle.
• Cookie policies. These commonly refer to the ICO and its guidance. Again, no urgency, but worth picking up when the policy is next reviewed.
• Training materials. If your GDPR or data protection training slides reference the Information Commissioner’s Office by full name, update them for the next training session.

None of these changes needs to happen before 30 September as the continuity provisions put in place will cover the gap. But leaving outdated regulator names in client-facing documents for months after a well-publicised change does not reflect well on a firm that handles data protection as part of its day-to-day obligations.

Should Firms Expect a Tougher Regulator?

The transition itself does not change the Commission’s underlying UK GDPR enforcement functions or the maximum penalties available. Nothing about 30 September alters what the regulator can do to a firm that gets data protection wrong.

What is changing is the scrutiny the regulator itself is under and how that could have a knock-on impact for firms. The Data (Use and Access) Act now requires the Information Commission to publish an annual analysis of its performance using key performance indicators, alongside an annual report on regulatory action covering investigations, the time they take, and the powers used. A regulator required to publish those metrics will face pressure to show what its interventions are achieving.

The regulator has also gained stronger investigatory tools since February 2026, including the power to issue interview notices compelling individuals to attend and answer questions, and the ability to require an organisation under an assessment notice to commission and pay for an independent report where specialist or technical evidence is needed.

For law firms, the practical consequence is straightforward. A regulator with stronger tools, a board watching its decisions, and a statutory obligation to report publicly on its enforcement activity is one that is more likely to act visibly and consistently. Data protection compliance that relies on the ICO being slow or under-resourced is not a strategy with a long shelf life.

For Firms on Our Compliance Services

If your firm is on our SRA Compliance Essentials or Fully Outsourced Risk and Compliance Management service, or the Full GDPR & Data Protection Compliance Service, your compliance team will be in touch to update the relevant policies and documentation as part of your next review cycle. No action is needed from you.

For All Other Firms

If your firm is not currently on one of our RACO compliance service and you would like help reviewing and updating your data protection policies, privacy notices, and client-facing documentation, our GDPR & Data Protection Services team can assist. We also provide Training covering GDPR and data protection obligations, including updates to reflect the new regulatory structure.

Speak to Our Compliance Team

To discuss how this change affects your firm’s documentation, or any other aspect of your data protection arrangements, call us on 0203 985 8550, complete the online enquiry form, or email us at info@regulationandcomplianceoffice.co.uk