ICO (Information Commissioner's Office, United Kingdom)
The UK data protection authority, which receives breach notifications within 72 hours under the UK GDPR (UK General Data Protection Regulation) and imposes fines, and which became on September 30, 2026 an Information Commission run by a board.
The ICO (Information Commissioner's Office) is the UK data protection authority: it receives breach notifications, imposes fines, and on September 30, 2026 took the form of an Information Commission run by a board. On October 16, 2020, the ICO fined British Airways 20 million pounds; on October 30, it fined Marriott 18.4 million as lead supervisory authority, after the other EU authorities concerned, the CNIL (Commission nationale de l'informatique et des libertés) among them, had approved the draft. The July 2019 notices of intent had proposed 183.39 and 99.2 million: the companies' cooperation and the pandemic's economic impact account for most of the cut. Both cases came from 2018 breaches, about 400,000 customers and staff at British Airways, 339 million guest records at Marriott. Since leaving the EU, the ICO enforces the UK GDPR (UK General Data Protection Regulation) and the Data Protection Act 2018. That framework requires breach notification within 72 hours of becoming aware, and communication to individuals where risk is high, on the model of GDPR Articles 33 and 34. A company serving both EU and UK customers notifies twice, under twin texts that are slowly drifting apart. The Data (Use and Access) Act 2025, which received Royal Assent on June 19, 2025, reforms the authority. Its sections 118 and 119 came into force on September 30, 2026 under commencement regulations made on September 10: the office of Information Commissioner is abolished and its functions pass to the new body. Ongoing investigations and proceedings carry over without a break, and the ICO name stays in use. For the underwriter, two points. Regulatory investigation cover in a UK policy should refer to the authority by its function; wording that names the “Information Commissioner” holds thanks to the transitional provisions, but it deserves a reread at renewal. And the 2020 amounts, cut to a fraction of the proposals, give a better measure of UK fine exposure than the statutory caps, which say nothing about practice.
Textbook case: a fictional tour operator, the French subsidiary of a London group, loses 300,000 customer files, 120,000 in the UK and 180,000 in the EU. Two notifications within 72 hours, to the ICO (Information Commissioner's Office) and to the CNIL (Commission nationale de l'informatique et des libertés), two sets of counsel, two investigation timetables. Defense before each authority estimated at 150,000 euros: 300,000 euros falling on regulatory investigation cover, before any fine, which the policy will pay only as far as each legal system allows.
ICO, Information Commissioner's Office, Information Commission, UK data protection regulator, UK Information Commissioner, UK GDPR regulator
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.