On 30 September the government abolishes the Information Commissioner's Office and hands its powers to a new regulator. That regulator will not have finished interviewing for its own chair.
Estimated reading time: 6 minutes
In short. The Data (Use and Access) Act 2025 abolishes the Information Commissioner's Office and replaces it with a board-led Information Commission. The government's own factsheet said the switchover would be "commenced separately to align with the appointment of the Information Commission." The Cabinet Office's own recruitment listing for the chair, the post that legally keeps the title "Information Commissioner", shows applications closed on 14 September 2026, sifting starts 22 September, and interviews are "expected to end" on 6 November. The commencement regulations already made bring the abolition into force on 30 September, five weeks before that interview process is even due to finish. Two documented mistakes: four stars.
The Information Commissioner's Office has enforced UK data protection law, alone, under one named office holder, since 1984. On 30 September 2026 that office is abolished by law and its powers pass to a new body corporate, the Information Commission, run by a board rather than an individual. The government set out exactly how it meant to sequence this. What it has actually scheduled does not match what it said.
The claims, tested
| The document's own words | What the record actually shows | Verdict |
|---|---|---|
| The Data (Use and Access) Act factsheet: ICO, published by DSIT on 27 June 2025, on sections 118 to 120 of the Act (abolition of the Information Commissioner and transfer of functions): "Sections 118-120 will be commenced separately to align with the appointment of the Information Commission" [1] | The Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026, made this year, bring sections 117(4)(a), 118 and 119 into force on 30 September 2026 [2]. The Cabinet Office's own listing for the Information Commission chair shows an application deadline of 14 September 2026, sifting on 22 September, and interviews "expected to end on" 6 November 2026 [3] | The abolition date does not align with the appointment of the chair; it lands five weeks before the interview process for that role is even due to finish |
| GOV.UK's live "plans for commencement" guidance, the government's own single reference page for when the Act takes effect, on Part 6 governance changes: "Changes to the Information Commissioner's Office (ICO) governance structures in Part 6 of the Act will take place once members of the Information Commission's new Board have been appointed. This is expected in early 2026" [4] | The page was last updated 5 February 2026 and lists commencement regulations only up to No. 6. Four further commencement regulations have since been made, Nos. 7 to 10, the last of which (No. 9) sets the 30 September abolition date [5] [6] [2]. The seven non-executive board members were not appointed until 15 July 2026, five months after "early 2026" [7] | A reader consulting the government's own official commencement tracker today would not learn the ICO is being abolished in two weeks, or that its board still has no chair |
The mistakes, counted
A commencement date that does not align with the appointment it was promised to align with (1). DSIT's own factsheet on the ICO's governance reform was explicit about sequencing: sections 118 to 120, which abolish the office of Information Commissioner and transfer its functions and property to the new Information Commission, "will be commenced separately to align with the appointment of the Information Commission" [1]. The Commission's chair is not a ceremonial addition to that board; under the new Schedule 12A inserted into the Data Protection Act 2018, the chair retains the statutory title "Information Commissioner" [1]. The commencement regulations actually made set the abolition and transfer for 30 September 2026 [2]. The Cabinet Office's own public appointments listing for that chair role shows applications closed on 14 September 2026, a shortlisting panel sits on 22 September, and interviews are "expected to end on" 6 November 2026, with the caveat that "timeline dates are only an estimate and can change" [3]. Even before a preferred candidate can be named, they must appear before a parliamentary select committee for pre-appointment scrutiny [3]. On the government's own published timeline, the Information Commission takes on sole legal responsibility for enforcing UK data protection law, freedom of information law and the NIS Regulations five weeks before the interview process for its own chair is even scheduled to conclude.
The government's own commencement tracker has not tracked its own commencement (2). GOV.UK publishes a standing guidance page, "Data Use and Access Act 2025: plans for commencement", specifically so the public can follow how and when the Act takes effect [4]. Its account of Part 6 board appointments says only that this "is expected in early 2026" [4]. The page's own footer records it was last updated 5 February 2026, and its regulation table stops at Commencement No. 6. Four more commencement instruments have been made since, confirmed by fetching each directly: No. 7 (26 February 2026) [5], No. 8 (17 March 2026) [6], and No. 9 (which sets the 30 September abolition date) [2]. None of them appear on the page. Nor does the board appointment news the page's own prediction was about: seven non-executive members were appointed on 15 July 2026, and chair recruitment launched the same day [7], five months after the page's "early 2026" estimate and still seven months before an update was made to say so.
Credit where due
The governance model the Act introduces is a real structural improvement. The ICO has operated since 1984 as a corporation sole, meaning every power and every decision rested in law with one individual [1]. A board with a chair, chief executive and non-executive members sharing decision-making responsibility is a recognised, more resilient model, and DSIT is right that it brings the regulator in line with comparable bodies [1]. The seven non-executive appointments made in July are not a token gesture either: they include a former Deputy Chair of Ofcom, a former senior civil service Director General, and directors with public-body governance experience across housing, health and financial regulation [7]. The Act's new statutory objectives for the regulator, requiring it to weigh innovation, competition, public security and children's protection alongside its core data protection duty, and to publish a strategy and report against it to Parliament, are a genuine tightening of accountability, not just rhetoric [8]. The problem here is not the design. It is that the government told the public the switchover would wait for the board to be in place, and is proceeding without that condition met.
Verdict
Four stars, from two documented mistakes. The Data (Use and Access) Act's board-led model for data protection regulation is a defensible reform, built on genuine, published statutory objectives and a credible slate of non-executive appointments. But the government's own factsheet promised the ICO's abolition would be timed to the new board's appointment, and its own recruitment portal shows the chair, the office that keeps the legal title "Information Commissioner", will not have finished being interviewed until five weeks after that abolition takes effect. The single guidance page meant to let the public track any of this has not been updated since February.
Sources
- Data (Use and Access) Act factsheet: ICO, GOV.UK / Department for Science, Innovation and Technology, published 27 June 2025
- The Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026, legislation.gov.uk
- Information Commission Chair - appointment details, Apply for a public appointment / Cabinet Office
- Data Use and Access Act 2025: plans for commencement, GOV.UK / Department for Digital, Culture, Media and Sport and Department for Science, Innovation and Technology, published 25 July 2025, last updated 5 February 2026
- The Digital Economy Act 2017 (Commencement No. 2) (Northern Ireland) and Data (Use and Access) Act 2025 (Commencement No. 7) Regulations 2026, legislation.gov.uk
- The Victims and Prisoners Act 2024 (Commencement No. 10) and Data (Use and Access) Act 2025 (Commencement No. 8) Regulations 2026, legislation.gov.uk
- Seven non-executive members appointed to Information Commission Board as chair recruitment launches, GOV.UK / Department for Science, Innovation and Technology, Information Commissioner's Office and The Rt Hon Liz Kendall MP, published 15 July 2026
- Data (Use and Access) Act 2025, legislation.gov.uk