On September 30, 2025, the UK's data protection supervisory authority transitioned from a single-person leadership to a committee structure. The Information Commission replaced the Information Commissioner as the statutory body, moving from a "corporation sole" to a corporate board with executive and non-executive members. This change means that every regulatory power that once belonged to one individual now rests with a collective decision-making body.
The Data (Use and Access) Act 2025, which received Royal Assent in June 2025, established this new structure. Paul Arnold serves as interim chief executive, and seven non-executive board members now share governance responsibilities. Maggie Carver is the deputy chair while the government searches for a permanent chair, a process expected to conclude by spring 2027.
What the Governance Shift Means
Decision-making becomes collective. Enforcement actions, guidance updates, and strategic priorities that once reflected a single commissioner's judgment now require board consensus. This could slow some decisions but may improve consistency across regulatory areas.
Leadership transition creates a gap. With no permanent chair until 2027, the ICO operates under interim leadership during a period when AI governance, cyber resilience, and children's privacy demand clear regulatory direction. Organizations seeking clarity on emerging issues may face longer waits for authoritative positions.
Geographic footprint expands. The supervisory authority moved its headquarters from Wilmslow to Oxford Road in Manchester. While the ICO frames this as access to talent and stronger business links, it also signals a physical departure from the established regulatory center. Your team may notice changes in which staff handle specific matters or how regional engagement works.
Regulatory functions remain unchanged. The ICO retains all existing powers under UK GDPR and the Data Protection Act 2018. Your transparency obligations, DSAR procedures, and breach notification requirements haven't shifted. The board structure affects how the supervisory authority operates internally, not what it requires from you.
Key Findings
The board composition favors external perspectives. Seven non-executive members join the executive team, bringing outside viewpoints into regulatory decision-making. This structure resembles corporate governance more than traditional regulatory models. Expect the ICO's positions to reflect broader stakeholder input rather than a single regulatory philosophy.
Strategic priorities are being rewritten. The ICO announced a new corporate strategy focusing on AI, cyber resilience, children's privacy, and public services. These aren't just topic areas, they signal where enforcement attention and guidance development will concentrate. If your organization handles automated decision-making or processes children's data, prepare for more detailed regulatory expectations.
Transition timing creates uncertainty. The permanent chair search extends into 2027, meaning strategic direction will evolve under interim leadership for at least 18 months. Regulatory priorities might shift again once permanent leadership takes over. Your compliance roadmap needs flexibility to accommodate this.
The ICO brand persists. Despite the legal restructuring, the organization will continue using the ICO name and existing contact points. Your team won't need to update processor lists or compliance documentation references. The familiar regulatory interface remains intact even as the underlying structure changes.
What This Means for Your Team
You're navigating a supervisory authority in transition. The board structure could produce more deliberative, consensus-driven guidance, or it could create internal disagreements that delay clear positions on emerging issues. Either way, you can't assume the ICO's response time or regulatory stance will mirror past patterns.
The focus areas announced, AI, cyber resilience, children's privacy, public services, tell you where scrutiny will intensify. If your organization deploys algorithmic systems, review your Article 22 compliance now. If you process children's data, revisit your age verification and parental consent mechanisms before the ICO publishes updated expectations.
The leadership gap matters more than it might appear. Without a permanent chair setting strategic direction, the ICO may avoid taking strong positions on contentious issues. If you're waiting for regulatory clarity on legitimate interests for analytics or international transfer mechanisms post-Schrems II, factor in additional delay.
Action Items by Priority
Immediate: Map your exposure to the ICO's stated priorities. Inventory where your organization uses AI or automated decision-making, how you secure personal data against cyber threats, and whether you process children's data. These areas will receive disproportionate regulatory attention. Identify gaps now before enforcement activity ramps up.
Within 90 days: Review your supervisory authority engagement strategy. If you've relied on informal guidance or back-channel discussions with ICO staff, recognize that decision-making now involves more stakeholders. Formal written inquiries may produce more reliable answers than phone calls. Adjust your approach to favor documented positions over verbal assurances.
By Q2 2026: Prepare for strategic shifts when permanent leadership arrives. The new chair won't join until spring 2027 at the earliest, but your compliance roadmap should anticipate strategic recalibration. Build flexibility into multi-year privacy initiatives so you can pivot if regulatory priorities change significantly under permanent leadership.
Ongoing: Monitor ICO guidance releases more closely. Board-based decision-making could produce more detailed, consensus-driven guidance documents. Watch for substantive updates to existing guidance on legitimate interests assessments, processor agreements, and breach notification thresholds. The collective structure may encourage the ICO to formalize positions it previously handled through informal channels.
Before major initiatives: Seek written regulatory positions. If you're planning significant changes to your processing activities, new legitimate interests grounds, expanded profiling, or novel international transfers, get the ICO's position in writing. Board governance creates more decision-makers, which can mean more varied interpretations. Documented positions protect you if regulatory views shift.
