Information Commissioner's Office
In short
The Information Commissioner's Office (ICO) is the UK's data protection regulator. It enforces the UK GDPR, including against AI companies. Since 30 September 2026 it is legally the Information Commission, run by a board, but still called the ICO.
- Also called
- ICO, Information Commission, Information Commission's Office, Information Commissioner
- Topic
- Law, policy and the UK
- Level
- Beginner
The ICO oversees how organisations handle personal data in the UK. It issues guidance, handles complaints and takes enforcement action, and also covers freedom of information and electronic marketing rules1.
It can fine heavily. For the most serious breaches of data protection law, the maximum is £17.5 million or 4% of worldwide annual turnover, whichever is higher2.
AI is a growing part of its work. It publishes guidance on AI and data protection, on explaining AI-assisted decisions to the people affected, and an AI and data protection risk toolkit3. In 2025/26 it published an AI and biometrics strategy4.
Its best-known AI case is Clearview AI. In May 2022 it fined the US company £7.5 million for scraping images of UK residents into a facial recognition database. In October 2025 the Upper Tribunal ruled the ICO did have jurisdiction, and in December 2025 Clearview was given permission to appeal to the Court of Appeal5.
The regulator has changed shape. The Data (Use and Access) Act 2025 abolished the office of Information Commissioner, a single person, and moved its functions to the Information Commission, a corporate body67. That switch took effect on 30 September 20267. Lewis Silkin reports the body is governed by a board and keeps the "ICO" name, now standing for the Information Commission's Office8.
Example
If a UK company used your photos to train a face recognition system without telling you, the ICO is the body you would complain to, and the one that fined Clearview AI for doing something similar5.
Why it matters
It is the main UK watchdog with power over how AI systems use personal data. Its guidance shapes what AI companies can do with UK users' information.
Questions people ask
Is the ICO now called the Information Commission?
Legally, yes. On 30 September 2026 the office of Information Commissioner was abolished and its functions moved to the Information Commission7. Lewis Silkin reports the regulator still uses the "ICO" name, now meaning the Information Commission's Office8.
Does the ICO regulate AI?
Not AI as such, but it regulates any use of personal data, which covers most AI systems. It publishes AI-specific guidance and toolkits3 and has taken action against Clearview AI5.
How much can the ICO fine a company?
Up to £17.5 million or 4% of total worldwide annual turnover, whichever is higher, for the most serious breaches of data protection law2.
Related terms
Sources
- ICO, Who we are (organisation pages and remit menu)
- Data Protection Act 2018, section 157 (maximum amount of penalty)
- ICO, Artificial intelligence guidance hub
- ICO, Information Commissioner's annual report 2025/26: a year in review
- ICO (8 October 2025), UK Upper Tribunal hands down judgment on Clearview AI Inc (updated 19 December 2025)
- Data (Use and Access) Act 2025, introductory text and long title ('to establish the Information Commission')
- The Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026, S.I. 2026/1015
- Lewis Silkin (29 September 2026), What the ICO's transformation into the Information Commission means for your organisation
- Data Protection Act 1984, section 3 (as enacted), establishing the Data Protection Registrar