According to the instrument published on legislation.gov.uk, the Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026 were made on 10 September 2026 under sections 142(1) and 143(1) of the 2025 Act. They are the ninth commencement regulations under that Act and take effect on 30 September 2026. The Regulations bring into force section 117(4)(a), section 118 and section 119 of the Data (Use and Access) Act 2025. In practical terms, that package removes a spent cross-reference, abolishes the office of the Information Commissioner and transfers the regulator’s functions to the Information Commission.
The Explanatory Note on legislation.gov.uk states that section 118 abolishes the office of the Information Commissioner and, as part of that change, omits Schedule 12 to the Data Protection Act 2018. Section 117(4)(a) makes a related technical amendment by removing an internal reference that is no longer needed once Schedule 12 falls away. Section 119 then transfers the statutory functions of the Information Commissioner to the Information Commission. This is an institutional reform measure rather than a fresh set of substantive data protection duties.
The key legal safeguard appears in regulation 3. Any act, omission or other thing done by, or in relation to, the Information Commissioner before 30 September 2026 is to be treated as done by, or in relation to, the Information Commission. The same applies to matters already in progress immediately before commencement, including legal proceedings. That wording is designed to preserve continuity across the handover. Live complaints, investigations, enforcement steps, notices and court matters can continue without needing to be restarted because the statute treats the new body as the legal successor for work already underway.
Regulation 4 addresses a narrower but important issue: the accounts for the financial year ending 31 March 2027. Despite the commencement of section 118, paragraph 11 of Schedule 12 to the Data Protection Act 2018 is preserved for that financial year, but the duties that paragraph places on the Information Commissioner are instead to be discharged by the Information Commission. The practical effect is to avoid a gap in accounting arrangements during the first reporting cycle after the transfer. Public finance, audit and reporting processes therefore continue on an express statutory footing while the new body assumes its role.
For organisations subject to UK data protection law, these Regulations do not themselves alter the day-to-day rules on lawful processing, transparency, enforcement thresholds or data subject rights. Their purpose is constitutional and administrative: they change the legal form of the regulator and ensure that the transfer does not unsettle existing decisions, proceedings or records. For complainants, regulated entities and legal advisers, the drafting provides a clear continuity rule. Existing dealings with the regulator remain legally effective after 30 September 2026 because the Regulations expressly carry them across to the Information Commission.
The instrument was signed on 10 September 2026 by Stephanie Peacock, Parliamentary Under-Secretary of State, for the Department for Digital, Culture, Media and Sport. As a commencement instrument, it does not create a new policy scheme on its own; its function is to activate selected parts of the primary legislation and manage the transition with sufficient precision to avoid uncertainty. For policy teams tracking the Data (Use and Access) Act 2025, the significance is now clear in law. From 30 September 2026, the single office of Information Commissioner gives way to the Information Commission, with statutory functions transferred and transitional protections in place to keep regulatory activity continuous.