The ICO is now the Information Commission: what your data processing agreements should say

SI 2026/1015, the Data (Use and Access) Act 2025 (Commencement No. 9) Regulations 2026, was made by the Secretary of State on 10 September 2026. It brings into force section 117(4)(a), section 118 and section 119 of the Data (Use and Access) Act 2025 on 30 September 2026. Section 118 abolishes the office of Information Commissioner. Section 119 transfers the Commissioner’s functions to the Information Commission.

That is a change of legal structure, not only of label. Documents that refer to the Information Commissioner as an office-holder now refer to an office that has been abolished, and the drafting question follows from that fact.

Two practical consequences follow. First, any agreement signed before 30 September 2026 that defines the regulator by reference to the office of Information Commissioner was drafted against a structure that has since changed. Second, the change was made by commencement regulations rather than by a sudden announcement, so it is a known and dated event that a counterparty can fairly be expected to have noticed.

Regulation 3 treats any act, omission or thing done by the Commissioner, including legal proceedings, as continuing under the Commission. For a business with an open investigation, a pending notice or a live enforcement matter, the practical reading is that exposure carries over rather than starting again with a new body.

Regulation 4 separately keeps the accounting duties in Schedule 12 to the Data Protection Act 2018 for the year to 31 March 2027. That is an administrative provision and does not affect your contract position, but it confirms that the transition was drafted for continuity rather than a clean break.

The point is not that every clause fails. Most will still be understood by sensible parties. The point is that a clean reference costs a few words to fix now and potentially a dispute about meaning later, and that is an easy trade for a commercial lawyer to recommend.

The ICO’s notice, published on 15 September 2026 and updated on 17 September, says the body will continue to be known as the ICO. That is a statement about how the organisation presents itself. It is useful for customers and data subjects, and it is a reason why many commercial teams may not notice the change.

A defined term such as “the Information Commissioner” or a reference to the Commissioner’s office in a data processing agreement is a different matter. A contract is interpreted on the words the parties chose. If those words point at an office that has been abolished, the clause relies on a reading of intention rather than on clear text, which is an avoidable risk.

This matters most where the clause carries a consequence: a warranty, a notification deadline, a termination trigger or an indemnity. Where the regulator is named in a recital or a background definition with no operative effect, the case for amendment is weaker, and it can be dealt with at the next scheduled review.

Data processing agreements commonly define the regulator, require the processor to cooperate with it, and require notice of regulatory contact. Warranties often state that no proceedings by the regulator are pending or threatened. Customer and vendor contracts may also require a party to notify the other of any investigation, audit or enforcement step.

Each of those provisions names the regulator in some way. Where the reference is to the Information Commissioner by title, or to the Commissioner as defined in older legislation, the clause should be reviewed. A warranty about regulatory proceedings is the most sensitive, because an inaccurate or unclear warranty can create a breach argument that has nothing to do with data handling.

Read each operative clause by asking what it would require of the parties if the regulator named in it were challenged to prove it still existed. If the honest answer is that the clause still works, note it and move on. If the answer depends on charitable interpretation, amend it.

The ICO notice does not address how existing notices are affected. SI 2026/1015 deals with continuity of things done by the Commissioner, which is not the same as stating how every private contract naming the Commissioner is to be read. It has not been established here that the Commission is a statutory successor for contracts generally.

The sensible response is therefore a drafting one. Treat a successor clause as advice on good practice, not as a statement of a legal holding. A short clause costs little to add, and avoids an argument about construction if a counterparty or a regulator is ever asked what the contract meant.

A pragmatic sequence is to search the contract portfolio for the Information Commissioner, the Commissioner, the ICO and the statutory definitions that sit behind them, then rank the hits by operative effect. Start with regulated counterparties and high-value data processing agreements, where the cost of a drafting argument is highest.

For new agreements and for the next amendment of existing ones, the following points are a reasonable starting position. They are drafting suggestions, not a statement of what the law requires.

• Name the Information Commission, and keep the reference to the ICO as a short form so that the definition matches how the regulator describes itself.
• Add “any successor or replacement authority”, so that a future structural change does not leave a clause pointing at nothing.
• Review regulatory-proceedings warranties, and state clearly whether they cover the Commissioner, the Commission and any proceedings continuing under it.
• Align notification and cooperation clauses, so that the duty to notify an investigation or cooperate with the regulator attaches to the body that now holds the function.
• Capture legacy references in an amendment, using a short variation that confirms references to the Commissioner are read as references to the Commission, rather than leaving the point to implication.