ICO
ICOAlso called information Commissioner's Office, information Commission
The ICO is the UK's independent regulator for data protection and information rights. It enforces the UK GDPR, the Data Protection Act 2018 and the electronic marketing rules in PECR. On 30 September 2026 the Information Commissioner was replaced by the Information Commission, a corporate body that keeps the ICO name.
How it works
The ICO issues guidance and codes of practice, handles complaints, receives personal data breach reports and investigates organisations. Firms report qualifying breaches within 72 hours of becoming aware of them. The ICO can issue information notices, carry out audits, order changes to processing and fine up to £17.5m or 4% of global annual turnover under the UK GDPR, whichever is higher.
For banks, insurers and payment firms, the ICO sits alongside the FCA and PRA. Data breaches, unlawful marketing and automated decisions about customers fall under its remit. Since 30 September 2026 the regulator has been run by a board with executive and non-executive members rather than a single commissioner, under the Data (Use and Access) Act 2025.
The rules
Sets the UK data protection framework and the Information Commissioner's functions and enforcement powers.
Organisations processing personal data in the UKAmends UK data protection law and replaces the Information Commissioner with an Information Commission run by a board.
Organisations processing personal data in the UK and the data protection regulatorAbolished the office of Information Commissioner and transferred its functions to the Information Commission.
The Information Commissioner and the new Information CommissionCommon questions
Is the ICO still called the ICO?
Yes. The Information Commission took over from the Information Commissioner on 30 September 2026 and continues to be known as the ICO. Its functions transferred to the new body, and the UK GDPR and Data Protection Act 2018 still apply.
What fines can the ICO issue?
Under the UK GDPR the ICO can fine up to £17.5m or 4% of total worldwide annual turnover, whichever is higher, for the most serious breaches. A lower tier of £8.7m or 2% applies to other infringements. It can also issue reprimands and enforcement notices.
How does the ICO work with the FCA?
The two regulators share information and coordinate where their remits overlap, such as data breaches at regulated firms or customer data used in financial products. A breach can lead to separate action by each regulator for data protection failures and for systems and controls failings.
Our coverage
News and analysis on regulatory change from RegTech Post.
Read the coverage →RegTech PostUnderstanding the ICO: The UK’s Independent Guardian of Data PrivacyRead the article →RegTech PostWhat ICO AI Data Protection Commitments Mean for AI DeployersRead the article →
