DSIT and the ICO have continued to work together on the transition to the Information Commission whilst the independent investigation was taking place. Due to the changes to the regulator’s governance structure, DSIT will be recruiting a Chair of the Information Commission in due course. A timetable will be set out when the campaign is launched.

The investigation focused solely on the allegations made against Mr Edwards.

Ministers were informed of workplace allegations relating to the Information Commissioner’s conduct on 16 February 2026.

Ministers were not informed of any complaints prior to this.

It is not appropriate to comment on who was interviewed as part of the investigation.

The allegations and subsequent independent investigation pertained to Mr Edwards alone; however, we are currently considering any further next steps.

We are confident in the adequacy of the process that was followed to appoint non-executive members to the new Information Commission. The recruitment campaign was launched last June and has concluded. It was carried out in accordance with the public appointments process and was regulated by the Commissioner for Public Appointments. The competition was fair and open, as provided for in legislation, and advertised on GOV.UK. The resulting appointments will be announced in due course.

We are looking at options following receipt of the report, working closely with the ICO who commissioned the investigation. It is important that any decision protects the witnesses and those who made the allegations.

While DSIT acts as the ICO's sponsor department within government, the ICO is an independent regulator accountable to Parliament. The ICO has a statutory duty to investigate complaints from data subjects to the extent appropriate and reports annually to Parliament on its approach to complaints and investigations.

The ICO does not publish complaint handling times by category of personal data. However, it triages all complaints based on the level of harm that alleged non-compliant practices may pose to data subjects.

To address its backlog, the ICO has introduced a new data protection complaints framework setting out how it assesses and prioritises each case. In addition, the Data (Use and Access) Act 2025 introduced a new requirement for all data controllers to establish procedures for responding to complaints, aiming to resolve issues at the earliest stage and reduce premature escalation to the ICO.

The Data (Use and Access) Act 2025 established the Information Commission, a new body corporate that will assume the ICO's regulatory functions to become the UK's independent data protection regulator. The Department for Science, Innovation and Technology (DSIT) and the Information Commissioner’s Office (ICO) are working closely on this transition, and while a date for it has not yet been set, work is well advanced.

The Information Commission will be led by a chair, chief executive, and other non-executive and executive members with shared decision-making responsibility. The new Board will be appointed as part of the transition process.

For clarity, there is no role titled “interim Chief Executive Officer of the Information Commissioner’s Office”. Following an open competition run by the ICO in March 2025, Paul Arnold was appointed as Interim Chief Executive of the Information Commission, a position which he will formally assume when the transition to the Information Commission takes place. He may serve in that role for a period of up to two years, after which time a recruitment process will be undertaken to fill the role on a permanent basis.

The Data (Use and Access) Act provides that the permanent Chief Executive will be appointed through open and fair competition by the Commission's non-executive members, in consultation with the Secretary of State for Science, Innovation and Technology.

Paul Arnold is currently serving as Interim Chief Executive Designate of the Information Commission, alongside his Deputy Commissioner responsibilities at the ICO. In his interim CEO designate role, Paul is leading and overseeing the transition to the new Information Commission. As for the use of titles, this, like other day-to-day operational matters, is a question for the independent regulator. I expect the ICO may have used "CEO" for brevity, but that would be for them to confirm.

The Data (Use and Access) Act 2025 established the Information Commission, a new body corporate that will assume the ICO's regulatory functions to become the UK's independent data protection regulator. The Department for Science, Innovation and Technology (DSIT) and the Information Commissioner’s Office (ICO) are working closely on this transition, and while a date for it has not yet been set, work is well advanced.

The Information Commission will be led by a chair, chief executive, and other non-executive and executive members with shared decision-making responsibility. The new Board will be appointed as part of the transition process.

For clarity, there is no role titled “interim Chief Executive Officer of the Information Commissioner’s Office”. Following an open competition run by the ICO in March 2025, Paul Arnold was appointed as Interim Chief Executive of the Information Commission, a position which he will formally assume when the transition to the Information Commission takes place. He may serve in that role for a period of up to two years, after which time a recruitment process will be undertaken to fill the role on a permanent basis.

The Data (Use and Access) Act provides that the permanent Chief Executive will be appointed through open and fair competition by the Commission's non-executive members, in consultation with the Secretary of State for Science, Innovation and Technology.

Paul Arnold is currently serving as Interim Chief Executive Designate of the Information Commission, alongside his Deputy Commissioner responsibilities at the ICO. In his interim CEO designate role, Paul is leading and overseeing the transition to the new Information Commission. As for the use of titles, this, like other day-to-day operational matters, is a question for the independent regulator. I expect the ICO may have used "CEO" for brevity, but that would be for them to confirm.

The Data (Use and Access) Act 2025 established the Information Commission, a new body corporate that will assume the ICO's regulatory functions to become the UK's independent data protection regulator. The Department for Science, Innovation and Technology (DSIT) and the Information Commissioner’s Office (ICO) are working closely on this transition, and while a date for it has not yet been set, work is well advanced.

The Information Commission will be led by a chair, chief executive, and other non-executive and executive members with shared decision-making responsibility. The new Board will be appointed as part of the transition process.

For clarity, there is no role titled “interim Chief Executive Officer of the Information Commissioner’s Office”. Following an open competition run by the ICO in March 2025, Paul Arnold was appointed as Interim Chief Executive of the Information Commission, a position which he will formally assume when the transition to the Information Commission takes place. He may serve in that role for a period of up to two years, after which time a recruitment process will be undertaken to fill the role on a permanent basis.

The Data (Use and Access) Act provides that the permanent Chief Executive will be appointed through open and fair competition by the Commission's non-executive members, in consultation with the Secretary of State for Science, Innovation and Technology.

Paul Arnold is currently serving as Interim Chief Executive Designate of the Information Commission, alongside his Deputy Commissioner responsibilities at the ICO. In his interim CEO designate role, Paul is leading and overseeing the transition to the new Information Commission. As for the use of titles, this, like other day-to-day operational matters, is a question for the independent regulator. I expect the ICO may have used "CEO" for brevity, but that would be for them to confirm.

The Data (Use and Access) Act 2025 established the Information Commission, a new body corporate that will assume the ICO's regulatory functions to become the UK's independent data protection regulator. The Department for Science, Innovation and Technology (DSIT) and the Information Commissioner’s Office (ICO) are working closely on this transition, and while a date for it has not yet been set, work is well advanced.

The Information Commission will be led by a chair, chief executive, and other non-executive and executive members with shared decision-making responsibility. The new Board will be appointed as part of the transition process.

For clarity, there is no role titled “interim Chief Executive Officer of the Information Commissioner’s Office”. Following an open competition run by the ICO in March 2025, Paul Arnold was appointed as Interim Chief Executive of the Information Commission, a position which he will formally assume when the transition to the Information Commission takes place. He may serve in that role for a period of up to two years, after which time a recruitment process will be undertaken to fill the role on a permanent basis.

The Data (Use and Access) Act provides that the permanent Chief Executive will be appointed through open and fair competition by the Commission's non-executive members, in consultation with the Secretary of State for Science, Innovation and Technology.

Paul Arnold is currently serving as Interim Chief Executive Designate of the Information Commission, alongside his Deputy Commissioner responsibilities at the ICO. In his interim CEO designate role, Paul is leading and overseeing the transition to the new Information Commission. As for the use of titles, this, like other day-to-day operational matters, is a question for the independent regulator. I expect the ICO may have used "CEO" for brevity, but that would be for them to confirm.

The Data (Use and Access) Act 2025 established the Information Commission, a new body corporate that will assume the ICO's regulatory functions to become the UK's independent data protection regulator. The Department for Science, Innovation and Technology (DSIT) and the Information Commissioner’s Office (ICO) are working closely on this transition, and while a date for it has not yet been set, work is well advanced.

The Information Commission will be led by a chair, chief executive, and other non-executive and executive members with shared decision-making responsibility. The new Board will be appointed as part of the transition process.

For clarity, there is no role titled “interim Chief Executive Officer of the Information Commissioner’s Office”. Following an open competition run by the ICO in March 2025, Paul Arnold was appointed as Interim Chief Executive of the Information Commission, a position which he will formally assume when the transition to the Information Commission takes place. He may serve in that role for a period of up to two years, after which time a recruitment process will be undertaken to fill the role on a permanent basis.

The Data (Use and Access) Act provides that the permanent Chief Executive will be appointed through open and fair competition by the Commission's non-executive members, in consultation with the Secretary of State for Science, Innovation and Technology.

Paul Arnold is currently serving as Interim Chief Executive Designate of the Information Commission, alongside his Deputy Commissioner responsibilities at the ICO. In his interim CEO designate role, Paul is leading and overseeing the transition to the new Information Commission. As for the use of titles, this, like other day-to-day operational matters, is a question for the independent regulator. I expect the ICO may have used "CEO" for brevity, but that would be for them to confirm.

While DSIT acts as the ICO’s sponsor department within government, it is an independent regulator and accountable to Parliament.

To address their backlog, the ICO has introduced a new data protection complaints framework that sets out how it assesses and prioritises each case and determines the extent to which it is appropriate to investigate. This approach is designed to help the ICO focus its resources on the most serious issues and provide more timely outcomes. The framework can be viewed at: https://ico.org.uk/make-a-complaint/data-protection-framework/.

From 19 June 2026 when relevant provisions in the Data (Use and Access) Act 2025 come into force, controllers will also be required to have a process in place to acknowledge data protection complaints from members of the public within a month of receipt and respond to the complaint without undue delay. If complaints are dealt with effectively by organisations, this will further reduce pressure on ICO’s resources.

While the Department for Science, Innovation and Technology (DSIT) is the Information Commissioner's Office (ICO)’s sponsor department within government and provide ICO’s Freedom of Information (FOI) funding as a Grant-in-Aid, government policy for Freedom of Information sits with the Cabinet Office.

The government is committed to ensuring sufficient funding for the ICO’s FOI responsibilities. Spending review budget allocations until Financial Year 2028-29 will be finalised by DSIT and will be published in due course.