The Information Commissioner's Office (ICO) is a non-departmental public body which reports directly to the Parliament of the United Kingdom and is sponsored by the Department for Science, Innovation and Technology. It is the independent regulatory office (national data protection authority) dealing with the Data Protection Act 2018, the General Data Protection Regulation, and the Privacy and Electronic Communications (EC Directive) Regulations 2003 across the UK; and the Freedom of Information Act 2000 and the Environmental Information Regulations 2004 in England, Wales and Northern Ireland and, to a limited extent, in Scotland.

The Data (Use and Access) Act 2025 provides for the abolition of the office of Information Commissioner and the transfer of functions to a new body, the Information Commission. , these measures have not come fully into effect.

The role of Information Commissioner is currently vacant, with chief executive Paul Arnold temporarily holding the Commissioner's responsibilities since John Edwards resigned on 19 June 2026 after an independent workplace investigation found that there was a case to answer.

Role of the Information Commissioner

The Information Commissioner is an independent official appointed by the Crown. The Commissioner's decisions are subject to appeal to an independent tribunal and the courts. The Commissioner's mission is to "uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals".

Replacement by the Information Commission The Data (Use and Access) Act 2025 created a body called the Information Commission, whose members (between 3 and 14 in number) are appointed by the Secretary of State. These measures came into force via statutory instrument in July 2025, but the provisions to abolish the office of Information Commissioner and transfer their powers to the commission are not yet in force .

Commissioners

John Edwards On 26 August 2021, John Edwards was named as the new Information Commissioner, replacing Elizabeth Denham. The UK government said he would "go beyond the regulator's traditional role" and that the job would now be "balanced" between protecting rights and promoting "innovation and economic growth". It also said that protection for privacy should be done "in as light a touch way as possible", that it would prioritise allowing personal data to be sent internationally to places such as the United States, Korea, Singapore, Dubai and Colombia, among others, that it wanted a data policy that delivered a "Brexit dividend" for businesses (cf. individuals alone) and that it wanted to get rid of "endless" cookie popups.

Edwards' resignation On 26 February 2026, Edwards stepped aside from his duties at the ICO while an independent investigation into unspecified HR matters was undertaken. On 10 June 2026, the ICO announced that the investigation has concluded, finding that there "is a case to answer". The matter now sits with the Department of Science, Innovation and Technology for consideration. During Edwards' absence, the ICO has been led by Paul Arnold (chief executive) and the wider executive team. At the conclusion of the investigation, Edwards has been deemed "temporarily unable to act in fulfilling his responsibilities", triggering a formal temporary transfer of responsibilities to Paul Arnold. On 19 June 2026, Edwards announced that he had resigned, acknowledging that his position had become untenable, and accepting that there had been occasions where he "exercised poor judgement and made attempts at humour that were inappropriate and caused offence".

Liz Kendall, UK Secretary of State for Science, Innovation and Technology, subsequently announced an independent review into the culture, accountability and governance of the ICO, and her intention to appoint a majority-women board of non-executive directors.

Elizabeth Denham

After Elizabeth Denham was appointed Britain's Information Commissioner in 2016, the ICO undertook high-profile investigations into Equifax, Yahoo, Talk Talk, Uber, and Facebook; issuing the maximum fine under the Data Protection Act 1998 of £500,000 to Facebook, for breaches of data protection law. Denham also oversaw the conclusion of the ICO's investigation into charities' fundraising activities and a series of fines for companies behind nuisance marketing.

Denham welcomed the introduction of the General Data Protection Regulation (GDPR) that came into effect in May 2018, as well as the Data Protection Act 2018.

Christopher Graham During his time as IC, Graham gained new powers: to issue monetary penalties for breaching the Data Protection Act 1998; to issue monetary penalties under the Privacy and Electronic Communications Regulations. He raised concerns over harm and distress caused by nuisance calls. Graham succeeded Richard Thomas in 2009.

Richard Thomas During Richard Thomas' tenure as Commissioner, the ICO was particularly noted for raising serious concerns over the Government's proposed British national identity card and database, as well as other similar databases such as the Citizen Information Project, Universal Child Database, and the NHS National Programme for IT, stating that the country was in danger of sleepwalking into a surveillance society,Patrick Foster, "Big Brother surveillance means no one is safe, experts warn", The Times, 27 March 2007, accessed 16 September 2007 drawing attention to the misuse of such information by the former states of the Eastern bloc and Francisco Franco's Spain.

Legislation

Data Protection Act 2018

The Data Protection Act 2018 received royal assent on 23 May 2018. It updates data protection laws in the UK, supplementing the General Data Protection Regulation (GDPR), implementing the EU law enforcement directive, and extending data protection laws to areas not covered by the GDPR. The new Act aims to modernise data protection laws to ensure they are effective in the years to come.

The data protection charge on UK data controllers to support the Act is under the Data Protection (Charges and Information) Regulations 2018. Exemptions from the charge were left broadly the same as for the previous Act: largely some businesses and non-profits internal core purposes (staff or members, marketing and accounting), household affairs, some public purposes, and non-automated processing. The register of fee payers, which excludes those data controllers that are exempt from paying a fee, is publicly available and searchable at the website of the ICO, which also gives links to the ICO's counterparts around Europe.

Data Protection Act 1998

The United Kingdom as a member of the European Union was, and as a former member still is, subject to a strict regime of data protection. The Data Protection Act 1984 created the post then named Data Protection Registrar with whom people processing personal data had to register the fact of their processing of that data on the register of data controllers. Under the provisions of EC Directive 95/46 (introduced in the UK as the Data Protection Act 1998, rather than as an SI under the European Communities Act 1972), the name of the post was changed to Data Protection Commissioner and later to Information Commissioner.

General Data Protection Regulation (GDPR) The General Data Protection Regulation (GDPR) is a new, Europe-wide law that replaces the Data Protection Act 1998 in the UK. The GDPR came into force on 25 May 2018 and sets out requirements for how organisations need to handle personal data. It forms part of the data protection regime in the UK, together with the new Data Protection Act 2018 (DPA 2018). Following the UK's departure from the EU on 31 January 2020, the GDPR continues to be part of British domestic law by virtue of section 3 of the European Union (Withdrawal) Act 2018.

Freedom of Information Act 2000 and Environmental Information Regulations 2004 In 2005 the Commissioner's role was expanded to include enforcement of the Freedom of Information Act 2000 and Environmental Information Regulations 2004 and the name of the position was changed from Data Protection Commissioner to Information Commissioner ('IC'). Enforcement of the Freedom of Information (Scotland) Act 2002, which applies to devolved public authorities in Scotland, is the responsibility of the Scottish Information Commissioner, a separate public official, as the British Act does not apply to these authorities.

The ICO issues guidance on Freedom of Information legislation, which is being updated in accordance with its strategic plan 2019/20 - 2021/22, Openness by Design.ICO, "About the Guide to freedom of information", accessed 26 December 2021.

Privacy and Electronic Communications Regulations (EC Directive) 2003 (PECR) In November 2011 the ICO was given the powers to impose monetary penalties of up to £500,000 for breaches of the Privacy and Electronic Communications Regulations (PECR). PECR applies to organisations that wish to send marketing messages through electronic means i.e. phone, fax, email, text; use cookies or provide electronic communication services to the general public. As with the GDPR, these regulations continue to apply following Brexit.

Nuisance calls In March 2013, commenting on a fine of £90,000 imposed on Cumbernauld fitted kitchen company DM Design for nuisance marketing calls, the Information Commissioner said that "this fine will not be an isolated penalty. We know other companies are showing a similar disregard for the law and we've every intention of taking further enforcement action against companies that continue to bombard people with unlawful marketing texts and calls." In 2014, the Government changed the law to "lower the legal threshold for consumer harm". This made it easier for the ICO to "take enforcement action against more organisations breaching the Privacy and Electronic Communications Regulations (PECR)".

In October 2018 the ICO fined two companies a total of £250,000 that made nearly 1.73 million direct marketing phone calls to people registered with the Telephone Preference Service (TPS). In December 2018, the Commissioner welcomed the new law that means the ICO can now hold company bosses directly responsible and has the power to fine them personally for breaches of the Privacy and Electronic Communications Regulations (PECR).

Environmental Information Regulations 2004 The Information Commissioner is also responsible for appeals made under the Environmental Information Regulations 2004.

Enforcement Prior to 2010 the enforcement powers were limited to issuing enforcement notices and to pursuing those alleged to have broken the Data Protection Act 1998 through the courts. In 2010 The Information Commissioner was granted the power to issue fines, known as monetary penalties, by its own authority, granted in April 2010. The first such were served on 24 November 2010. From 2010, the ICO were also given the powers to serve Assessment Notices, which can be issued to organisations who are unwilling to work alongside the ICO and are at risk of breaking the principles of the Data Protection Act 1998. During the Leveson Inquiry in 2012 it came to light that the ICO had felt unable to challenge the press related to allegations of breaches due to the power of the press and perceived weakness of its own powers.

From 25 May 2018 the ICO were granted new enforcement powers under the new data protection laws, including the ability to fine organisations €20 million (or equivalent in sterling) or 4% of the total annual worldwide turnover in the preceding financial year, whichever is higher, for breaching data protection laws.

Investigations Operation Motorman