The Information Commissioner's Office (ICO) has confirmed that it will transition to the Information Commission on 30 September 2026, following changes introduced by the Data (Use and Access) Act 2025, with the relevant provisions brought into force on that date by the Data (Use and Access) Act 2025 (Commencement No 9 and Transitional and Saving Provisions) Regulations 2026, SI 2026/1015. The changes affect the organisation's governance structure while maintaining its existing regulatory functions and responsibilities. Seven non-executive members appointed to the new Information Commission Board will assume their roles on 30 September 2026. Following the transition, the Information Commission's Office will continue to be known as the ICO.

The Information Commissioner’s Office (ICO) has announced its formal transition to the Information Commission under the Data (Use and Access) Act 2025 (DUAA 2025). The new Information Commission Board now oversees the ICO’s work and has appointed Maggie Carver as Deputy Chair while recruitment for a permanent Chair continues. The Information Commission has also opened its headquarters in Manchester. Its responsibilities and public services continue, and its forthcoming corporate strategy will address artificial intelligence, cyber resilience, children’s privacy and public services across the UK.

ARCHIVED: This archived Practice Note tracks key consultations conducted by the Information Commission’s Office (ICO) in 2023. Information is correct up to 31 December 2023. The tracker is not maintained and is for background information only. For information about ICO consultations from 1 January 2024 onwards, see Practice Note: ICO consultations tracker 2024. This Information Law consultations tracker displays the current status, and most recent developments in key consultations being conducted by the Information Commission’s Office (ICO) from 1 January 2023. The ICO conducts consultations from time to time on issues such as the efficacy and clarity of draft guidance it is due to publish relating to the legislation it covers, such as the United Kingdom General Data Protection Regulation, Retained Regulation (EU) 2016/679 (UK GDPR). Other legislation falling within the ICO’s remit includes the: • Data Protection Act 2018 (DPA 2018) • Privacy and Electronic Communications Regulations 2003 (PECR 2003), SI 2003/2426 • Freedom of Information Act 2000 (FIA 2000) • Environmental Information Regulations 2004 (EIR 2004), SI 2004/3391 • INSPIRE Regulations

ARCHIVED: This archived Practice Note tracks key consultations conducted by the Information Commission’s Office (ICO) in 2024. Information is correct up to 31 December 2024. The tracker is not maintained and is for background information only. For information about ICO consultations from 1 January 2025 onwards, see Practice Note: ICO consultations tracker 2025 [Archived]. This Information Law consultations tracker displays the current status, and most recent developments in key consultations being conducted by the Information Commission’s Office (ICO) from 1 January 2024. The ICO conducts consultations from time to time on issues such as the efficacy and clarity of draft guidance it is due to publish relating to the legislation it covers, such as the United Kingdom General Data Protection Regulation, Retained Regulation (EU) 2016/679 (UK GDPR). Other legislation falling within the ICO’s remit includes the: • Data Protection Act 2018 (DPA 2018) • Privacy and Electronic Communications Regulations 2003 (PECR 2003), SI 2003/2426 • Freedom of Information Act 2000 (FIA 2000) • Environmental Information Regulations 2004 (EIR 2004), SI 2004/3391 • INSPIRE Regulations

ARCHIVED: This archived Practice Note tracks key consultations conducted by the Information Commission’s Office (ICO) in 2025. Information is correct up to 31 December 2025. The tracker is not maintained and is for background information only. For information about ICO consultations from 1 January 2026 onwards, see Practice Note: ICO consultations tracker 2026 [Archived]. This Information Law consultations tracker displays the current status, and most recent developments in key consultations being conducted by the Information Commission’s Office (ICO) from 1 January 2025. The ICO conducts consultations from time to time on issues such as the efficacy and clarity of draft guidance it is due to publish relating to the legislation it covers, such as the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR). Other legislation falling within the ICO’s remit includes the: • Data Protection Act 2018 (DPA 2018) • Privacy and Electronic Communications Regulations 2003 (PECR 2003), SI 2003/2426 • Freedom of Information Act 2000 (FIA 2000) • Environmental Information Regulations 2004 (EIR 2004), SI 2004/3391 • INSPIRE Regulations

ARCHIVED: This archived Practice Note tracks key consultations conducted by the Information Commission’s Office (ICO) in 2026. Information is correct up to 21 July 2026. The tracker is not maintained and is for background information only. For information about ICO consultations from 22 July 2026 onwards, see Practice Note: Information Law—horizon scanner—Consultations and calls for evidence. This Information Law consultations tracker displays the current status, and most recent developments in key consultations being conducted by the Information Commission’s Office (ICO) from 1 January 2026. The ICO conducts consultations from time to time on issues such as the efficacy and clarity of draft guidance it is due to publish relating to the legislation it covers, such as the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR). Other legislation falling within the ICO’s remit includes the: • Data Protection Act 2018 (DPA 2018) • Privacy and Electronic Communications Regulations 2003 (PECR 2003), SI 2003/2426 • Freedom of Information Act 2000 (FIA 2000) • Environmental Information Regulations 2004 (EIR 2004), SI 2004/3391 • INSPIRE Regulations

The Information Commissioner's Office (ICO) has launched a consultation on the 'consent or pay' model, which gives people the choice to use a website for free if they consent to their personal information being used for personalised advertising, or pay a fee and not be tracked. The consultation aims to inform the ICO's position on how organisations can use this model and comply with data protection laws. As part of its reflection, the ICO attended a joint Interactive Advertising Board (IAB) UK/Association of Online Publishers (AOP) meeting with the members of those organisation to enable the advertising industry to put its queries to the ICO about different aspects of legal compliance. The ICO also wrote a letter to respond to the IAB and AOP's queries. The ICO's consultation closes on 17 April 2024.

The Information Commissioner's Office (ICO) has launched a consultation on its draft corporate strategy. The two-year strategy (2026–28) is designed to bridge the current ICO25 strategy and the forthcoming transition to an Information Commission model, mandated by the Data Use and Access Act 2025 (DUAA 2025). The draft strategy states that this governance transition—from a single Information Commissioner to a Commission structure with a non-executive Chair, Board and separate CEO—is anticipated for autumn 2026. The draft strategy's stated purpose is to build trust in responsible UK data use and innovation. It sets four regulatory priorities: (1) protecting children's personal data online; (2) promoting trust and transparency in artificial intelligence (AI); (3) ensuring public services use data responsibly and (4) building cyber resilience. Three transformation priorities are also outlined: (1) streamlining customer services; (2) becoming more data-driven and digitally enabled and (3) strengthening people capability and culture. With an annual operating budget of approximately £116 million, the ICO will focus resources on areas of highest risk. The consultation closes on 23 August 2026.

The Information Commissioner's Office (ICO) has published a consultation on its draft updated guidance on encryption. Respondents are asked to provide details about themselves and their organisations, share their views on encryption and data protection law, offer feedback on the encryption scenarios outlined in the guidance, and provide any additional comments. Responses are sought by 24 June 2025.

The Information Commissioner's Office (ICO) has launched a consultation on draft updated guidance concerning the research, archiving and statistics (RAS) provisions. The updates follow the introduction of the Data (Use and Access) Act 2025 (DUAA 2025) and include revised criteria for scientific research, in response to requests for greater clarity. The consultation also seeks views on the ICO's approach to the new disproportionate effort exemption under DUAA 2025, s 77, which exempts organisations from the requirement to inform data subjects when re-using previously collected data for research purposes. The consultation closes on 27 April 2026.

The Information Commissioner’s Office (ICO) has launched a consultation on updated guidance on automated decision-making (ADM), including profiling. The update follows the introduction of the Data (Use and Access) Act 2025 and focuses on provisions specific to this area. It is aimed at data protection officers, compliance professionals and technical leads. The ICO explains that the new guidance provides more detailed information on automated decision-making as defined in Articles 22A–22D of the UK General Data Protection Regulation (UK GDPR), where decisions are based solely on automated processing and have legal or similarly significant effects on individuals. It is intended to support organisations in understanding and meeting their obligations in this context, including when profiling is involved, and will inform the development of a statutory code of practice on artificial intelligence and automated decision-making. The ICO also confirms that the previous version of the guidance will be withdrawn once the updated version is finalised following the consultation. The consultation closes on 29 May 2026.

The Information Commissioner's Office (ICO) has announced the continuation of its public sector approach following a two-year trial. The approach, which emphasises proactive engagement and reduced fines for public authorities, has shown positive impact according to a review. The ICO is now consulting on the scope of the approach and circumstances for issuing fines to public bodies until 31 January 2025. The Information Commissioner has also committed to improving engagement beyond central government and ensuring senior leaders take accountability for data protection compliance.