The Information Commission has replaced the Information Commissioner as the UK's statutory privacy and data regulator. Under the old structure, the regulator was a "corporation sole," meaning all powers and responsibilities resided in one person. That individual now gives way to a corporate body with executive and non-executive board members.
The change follows the resignation of former Information Commissioner John Edwards in June after an independent workplace investigation found he had a "case to answer." Edwards acknowledged that his conduct, including attempts at humor, had been "inappropriate and caused offense" and that his position had become "untenable." He had stepped back from duties in April before fully resigning. Paul Arnold, who assumed Edwards' statutory responsibilities before the resignation, is serving as interim chief executive of the new commission.
Seven non-executive members have joined the board. They appointed Maggie Carver as deputy chair; she will perform the chair's duties while the government conducts a permanent search, expected to conclude by spring 2027.
The regulator has also relocated its headquarters from Wilmslow to Oxford Road in Manchester, citing access to a "diverse talent pool" and closer ties to businesses and communities across the UK.
For most stakeholders, day-to-day dealings with the ICO will not change. The Information Commission retains the same powers and responsibilities for data protection and freedom of information. A new corporate strategy is in development, with priorities including artificial intelligence, cyber resilience, children's privacy, and public services. Despite the legal overhaul, the organization will continue to go by the ICO initials.