Information Commission takes over on 30 September 2026

Sometimes the driest legal notice hides the simplest question: if the UK’s data watchdog changes shape, do complaints and investigations stop halfway through? The answer in this new statutory instrument is no. From 30 September 2026, sections 117(4)(a), 118 and 119 of the Data (Use and Access) Act 2025 are brought into force so the office of the Information Commissioner is abolished and its functions move to the Information Commission. (lexisnexis.co.uk) That sounds like a dramatic rename, but it is better understood as a legal handover. The government’s own factsheet says the role of the regulator is not meant to disappear; the same public duties continue, but through a different governing body. (gov.uk)

If you are wondering what the difference is, the old model placed the regulator’s powers in one office-holder. Part 6 of the 2025 Act sets up the Information Commission as a body corporate instead, and the official explanatory notes say it replaces the previous regulator, which was structured as a corporation sole. (legislation.gov.uk) Government factsheets describe the new set-up as shared decision-making, led by a chair, a chief executive and other executive and non-executive members. They also note one detail that may confuse readers at first glance: the chair will still carry the title “Information Commissioner”, even though the legal office itself is being abolished. (gov.uk)

The structure matters because it changes who the law sees as the decision-maker. Schedule 12A of the Data Protection Act 2018, inserted by the 2025 Act, says the Commission must have at least 3 members and no more than 14, and that non-executive members should, so far as practicable, outnumber executive members. (legislation.gov.uk) **What this means:** if you study regulation, this is a move away from a one-person legal office towards a board-style body. The government argues that this should make decision-making more resilient and more representative; whether that happens in practice is something we will only be able to judge over time. (gov.uk)

For most people, the part that matters most is continuity. The regulations say that anything done by or in relation to the Information Commissioner before 30 September 2026, including legal proceedings already under way, is to be treated as something done by or in relation to the Information Commission and can carry on. (lexisnexis.co.uk) **What this means for you:** if a complaint, investigation, enforcement process or court case is already moving, the law is designed to stop it falling into a gap during the switchover. You should read this as a continuity rule, not a reset button. (lexisnexis.co.uk)

There is a small but important finance paragraph too. For the financial year ending 31 March 2027, the old accounting rule in Schedule 12 to the Data Protection Act 2018 is kept alive for this purpose, but the duties are to be carried out by the Information Commission. (lexisnexis.co.uk) That may sound like paperwork, yet it answers a basic public-interest question: who signs off the books while one legal body disappears and another takes over? The regulations try to make sure there is no accounting hole during that change. (lexisnexis.co.uk)

One reason this instrument feels confusing is that the Information Commission was not born entirely on 30 September 2026. Official commencement material shows that Schedule 14 and part of section 117 were already brought into force on 20 August 2025, and a government factsheet said those provisions would establish the Commission first, without its full functions, with later sections to follow when appointments were aligned. (legislation.gov.uk) So the cleaner way to read this date is as the handover point. The Commission already existed in law; 30 September 2026 is when the office of the Information Commissioner is abolished and the functions formally transfer across. (lexisnexis.co.uk)

If you only need the plain-English version, here it is. Your data protection rights are not being switched off by this statutory instrument. The regulator keeps doing the job, but under a different legal structure, and the Act says the functions continue with the Information Commission. (gov.uk) **Why it matters:** this is the kind of institutional tidy-up that most people notice only when something goes wrong. For students, teachers and anyone trying to read government well, it is a useful reminder that a short technical regulation can still answer big questions about accountability, continuity and who holds power when institutions are rebuilt. (lexisnexis.co.uk)