The Data (Use and Access) Act 2025 (DUAA)[i] continues to introduce changes to the UK data protection landscape. One of the most visible developments is the formal transition of the UK’s data protection regulator from the Information Commissioner’s Office to the Information Commission[ii].

For many organisations, the change may initially appear to be little more than a rebrand. However, a more significant governance change sits behind the new name. Under the previous regime, the regulator was led by a single Information Commissioner. The DUAA replaces that structure with an Information Commission Board and a chief executive officer (CEO)[iii]. The Board is responsible for oversight, strategic direction, challenge and accountability, while the CEO oversees the day-to-day management and operation of the organisation.

The governance reforms also sit within a much broader package of changes introduced by the DUAA. While the transition from the Information Commissioner’s Office to the Information Commission is one of the most visible changes, organisations are already implementing a number of more substantive operational reforms. Most notably, the DUAA has introduced a new right for individuals to complain directly to controllers about alleged infringements of the UK GDPR, together with new obligations on organisations to establish accessible complaints processes, acknowledge complaints within prescribed timeframes and investigate and respond to concerns appropriately. These requirements form part of a wider emphasis on accountability, transparency and demonstrable compliance across the UK’s data protection framework.

As a result, many organisations are already reviewing privacy notices, data subject rights procedures, complaints handling processes and broader governance arrangements to ensure they remain aligned with the evolving regulatory landscape. Against that backdrop, the regulator’s new governance structure should be viewed as one element of a broader programme of reform rather than a standalone rebrand.

Importantly, the regulator’s core powers, responsibilities and functions remain unchanged. The Information Commission continues to oversee compliance with data protection, e-privacy and freedom of information legislation, publish guidance, investigate complaints and take enforcement action where appropriate. From a practical perspective, organisations should not expect any immediate change in the way they interact with the regulator.

That said, the transition provides a useful opportunity to review privacy and data governance documentation. Many policies, notices, contracts and internal procedures refer specifically to the Information Commissioner’s Office or the Information Commissioner. While those references are unlikely to create immediate compliance concerns, organisations may wish to update them over time to reflect the new statutory framework.

In particular, organisations should consider reviewing:

  • Privacy notices
  • Data protection policies
  • Data processing and data sharing agreements
  • Records of processing activities
  • Internal compliance procedures
  • Standard contractual templates

The governance reforms introduced by the DUAA are intended to modernise the regulator’s structure and bring it more closely into line with other UK regulatory bodies. Whether the new arrangements ultimately influence regulatory priorities, decision-making or enforcement activity remains to be seen.

For now, the key takeaway is straightforward: the ICO has a new legal identity and governance structure, but its role as the UK’s data protection regulator remains largely unchanged. However, the move should not be viewed in isolation. It sits alongside a wider programme of DUAA reforms that are already reshaping organisational privacy compliance frameworks and accountability obligations. As organisations continue to work through these changes, updating references to the regulator may be a small but worthwhile part of a broader compliance review.

For a summary of all the changes introduced by the DUAA, read our previous articles:

Disclaimer: While every effort has been made to ensure that the information contained in this article is accurate, neither its authors nor Squire Patton Boggs accepts responsibility for any errors or omissions. The content of this article is for general information only, and is not intended to constitute or be relied upon as legal advice.

[i] https://www.legislation.gov.uk/ukpga/2025/18/contents

[ii] https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-welcomes-transition-to-new-information-commission-and-marks-new-chapter-with-manchester-head-office-opening/

[iii] https://ico.org.uk/about-the-ico/who-we-are/the-information-commission-board/