Information Commission replaces UK data regulator on 30 September 2026

If you work with personal data, this is the kind of statutory instrument that can look small and still matter a great deal. Regulations made on 10 September 2026 bring sections 117(4)(a), 118 and 119 of the Data (Use and Access) Act 2025 into force on 30 September 2026. From that date, the office of the Information Commissioner is abolished and its functions move to the Information Commission. (policyindex.ai) That sounds dense, so let’s put it plainly. The UK’s data regulator is not being switched off and rebuilt from scratch; the law is changing the institution’s legal form and transferring its powers to a new body. For anyone trying to read this without a law degree, that is the big takeaway. (policyindex.ai)

To see why this matters, it helps to step back. The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, and its Explanatory Notes on legislation.gov.uk say Part 6 establishes the Information Commission as a body corporate to replace the existing regulator. The same notes explain that the current regulator is structured as a corporation sole, meaning the law has been organised around a single office-holder rather than a separate corporate body. (gov.uk) This September instrument is not the first step. The first commencement regulations had already brought most of section 117 and Schedule 14 into force on 20 August 2025, but section 117(4)(a) was left out at that stage. The new regulations now switch on that remaining paragraph alongside sections 118 and 119, completing the legal move from the old office to the new Commission. (legislation.gov.uk)

In everyday English, this is a story about governance rather than a whole new set of rights. The law is changing who formally holds the regulator’s powers, not announcing that the public must learn an entirely new data protection code overnight. That may sound like a fine distinction, but in public law these distinctions matter because institutions need a clear legal home for their powers, duties and records. (legislation.gov.uk) There is also a useful lesson here for students of politics and media. Big legal changes do not always arrive with a dramatic headline; sometimes they arrive through commencement regulations that look procedural but quietly alter who can act, decide and be held accountable. (gov.uk)

The most important protection in these regulations is continuity. Regulation 3 says that anything done, or already in the process of being done, by or in relation to the Information Commissioner before 30 September 2026 is to be treated as done, or being done, by or in relation to the Information Commission. The text explicitly includes legal proceedings. (policyindex.ai) **What this means for you:** complaints, investigations, enforcement work and court matters should not have to start again just because the institution’s legal form changes on 30 September 2026. The handover is designed to stop a bureaucratic gap opening up in the middle of live cases. (policyindex.ai)

There is another detail that looks dry but does real work. Regulation 4 keeps an old accounting rule in place for the financial year ending 31 March 2027, even though section 118 abolishes the office of the Information Commissioner. The duties under that rule are to be carried out by the new Information Commission, so the transfer does not leave a hole in the regulator’s accounts during the handover year. (policyindex.ai) The same explanatory material also makes clear why section 117(4)(a) is being commenced now. It removes an internal cross-reference in the Data Protection Act 2018 that is no longer needed once section 118 has taken effect and Schedule 12 to the 2018 Act is omitted. Not every legal change is dramatic; sometimes the law also has to tidy its own wiring. (policyindex.ai)

For readers trying to work out what happens to older documents, section 119 gives another reassurance. The Act’s Explanatory Notes say references to the Information Commissioner in enactments or other documents, whenever they were made, are to be treated as references to the Information Commission so far as appropriate after the transfer of functions. That helps older wording keep working in the new system. (legislation.gov.uk) So if you are a teacher updating materials, a student reading older case notes, or a worker checking a policy drafted before September 2026, the sensible reading is that the label may change while the legal thread continues. The law is trying to preserve meaning, not create avoidable confusion. (legislation.gov.uk)

Taken together, these are the ninth commencement regulations made under the Data (Use and Access) Act 2025, and they show how major reforms often arrive in stages rather than one giant legislative moment. GOV.UK’s own commencement guidance had already set out that the Act would be rolled out step by step, with different provisions starting at different times. (policyindex.ai) If you remember one thing, make it this: 30 September 2026 is the date when the office of the Information Commissioner gives way to the Information Commission in law. The point of the transitional rules is to make that shift feel less like a rupture and more like a controlled handover. That is good practice in public administration, and it is exactly the sort of quiet change worth learning to spot. (policyindex.ai)