The UK government's programme of implementing the Data (Use and Access) Act 2025 (DUAA) continues with the making of the Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/1015) (the Regulations). The Regulations bring into effect, from 30 September 2026, sections 117(4)(a), 118 and 119 of the DUAA, completing the statutory transition from the long-standing office of the Information Commissioner to the newly established Information Commission. With the commencement of these provisions, the principal data protection reforms and governance changes introduced by the DUAA are now, in the main, in force. Further information on the DUAA and the changes that have been enacted can be read here: The Data (Use and Access) Act 2025: key reforms in force - Stevens & Bolton LLP.
Information Commission
The commencement of these provisions formally abolishes the office of Information Commissioner and transfers the Commissioner's statutory powers and responsibilities to the Information Commission, a body corporate established under the DUAA reforms. There is now no leadership by a single Information Commissioner, ensuring clearer governance and more accountability, with the new set up reflecting that of other large UK regulators (such as the financial and competition watchdogs). In addition, the legislation provides that references to the Information Commissioner in legislation and other documents are, where appropriate, to be interpreted as references to the Information Commission, helping to ensure regulatory continuity following the change in governance structure.
Recognising the potential disruption that could arise from the replacement of the regulator's existing legal structure, the Regulations include transitional and saving provisions designed to also preserve continuity. These provisions ensure that actions taken by, or in relation to, the Information Commissioner before 30 September 2026 continue to have effect after the transfer. This includes ongoing investigations, enforcement activity, litigation, complaints, decisions and other proceedings connected with the Commissioner, which will continue seamlessly under the authority of the Information Commission. The Regulations also address financial governance during the transition period. A specific saving provision provides that the Information Commission will assume responsibility for the relevant accounting functions relating to the financial year ending 31 March 2027, thereby ensuring continuity in the preparation and oversight of the regulator's accounts notwithstanding the abolition of the predecessor office part way through that financial year.
Practical impact
For organisations, the practical impact is largely administrative rather than substantive. The commencement does not alter the underlying requirements of UK data protection law, but it does complete the institutional reforms introduced by Part 6 of the DUAA, replacing the corporation sole model of regulation with the board-governed Information Commission. Documents referring to the "Information Commissioner" do not need to be rewritten, however, forward-looking drafting (privacy notices, contractual regulator references, DPIAs and data sharing agreements, for example) should adopt the "Information Commission" terminology from 30 September 2026. See the ICO website for further information on its name change: The Information Commission.
