A short but important commencement instrument made on 10 September 2026 fixes 30 September 2026 as the date of the legal handover from the office of Information Commissioner to the Information Commission. SI 2026/1015 brings into force section 117(4)(a), section 118 and section 119 of the Data (Use and Access) Act 2025, and the Explanatory Note says those provisions relate to the replacement of the Information Commissioner with the Information Commission. For departments, public bodies and private sector data controllers, the immediate effect is institutional rather than substantive: the regulator continues, but its legal form changes. (policyindex.ai)
The latest SI completes a restructuring that has been phased over time. Section 117 of the 2025 Act had already inserted new section 114A into the Data Protection Act 2018, establishing the Information Commission as a body corporate, while Schedule 14 set out the new body's governance arrangements; earlier commencement provisions had already brought section 117 in part and Schedule 14 into force. Regulation 2 now activates the formal abolition of the office of Information Commissioner, the transfer of functions to the Information Commission, and a small but necessary housekeeping amendment removing an obsolete cross-reference in section 205(2)(l) of the 2018 Act. (legislation.gov.uk)
The operative continuity provision is regulation 3. It states that any act, omission or other thing, including legal proceedings, done by or in relation to the Information Commissioner before 30 September 2026, or already in progress immediately before that date, is to be treated as done, or capable of continuation, by or in relation to the Information Commission. The breadth of that drafting is important because it is designed to prevent live files from falling into a gap at the moment of transfer. In practice, that should cover ongoing complaints, investigations, enforcement work and litigation, although the instrument does not itemise those categories individually. (policyindex.ai)
The Act itself supports that continuity. Section 119 provides that, so far as appropriate, references to the Information Commissioner in enactments or other documents, whenever passed or made, are to be treated as references to the Information Commission. That means older statutory wording, guidance, notices and case documents are less likely to fail simply because the name of the legal office-holder has changed. For public administration, that is the practical value of the measure: it reduces the amount of immediate remedial drafting needed across government and regulated sectors on day one of the transfer. (legislation.gov.uk)
The governance change is not just a rebranding exercise. The Explanatory Notes to the 2025 Act say Part 6 replaces the existing regulator, currently structured as a corporation sole, with a body corporate, and new Schedule 12A describes the nature, form and governance structure of that body. Those notes say the Commission must have between three and 14 members, with arrangements for a chair, executive members and non-executive members, and that the Secretary of State must, so far as practicable, ensure non-executive members outnumber executive members. In plain terms, the regulator moves from a single-office model to a board-based structure for oversight and formal decision-making. (legislation.gov.uk)
Regulation 4 deals with a narrower but still important problem: accounts. For the financial year ending 31 March 2027, paragraph 11 of Schedule 12 to the Data Protection Act 2018 continues to apply to the accounts of the Information Commissioner, but the duties under that paragraph are to be discharged by the Information Commission. The Explanatory Note says the purpose of the saving is to ensure there are no accounting gaps while functions are transferred. For auditors, finance teams and parliamentary scrutiny bodies, that preserves an intelligible year-end trail through the institutional change. (policyindex.ai)
This is the ninth commencement instrument made under the Data (Use and Access) Act 2025, and it sits at the end of a longer implementation sequence rather than at its start. GOV.UK guidance had already signalled that most Part 5 data protection and privacy provisions would commence earlier, and the note to earlier commencement regulations in SI 2026/1015 records that section 117 in part, section 120 and Schedule 14 were already in force before this latest step. The practical reading is straightforward: from 30 September 2026, organisations should expect continuity in live dealings with the regulator while updating formal references from the Information Commissioner to the Information Commission where appropriate. (gov.uk)