The ICO at a turning point: what its final Annual Report reveals

Privacy & Data Protection (Volume 26, Issue 8, 2026) has published a detailed analysis by Daniel Bishop, Alison Llewellyn, Katie Hewson and Sarah O’Brien on the ICO’s final Annual Report and what it reveals about the regulator’s evolving enforcement priorities as it transitions to the new Information Commission.

The article covers:

• Enforcement trends and fining activity: recent high-profile fines and the implications of increased fining powers under PECR;

• The ICO’s priority areas: children’s privacy, AI and cybersecurity; and a look at where regulatory scrutiny is heading;

• The new complaints-handling regime: the practical impact of the ICO’s unprecedented complaints volumes, and what the new DUAA complaints-handling regime means for organisations’ internal processes; and

• Organisational accountability and governance: the regulator’s growing emphasis on organisational accountability and governance, and lessons from its Memorandum of Understanding with central government.

Click here to read the full analysis (PDF, courtesy of Privacy & Data Protection).