By Phil Gee · AI Academy, Southport
On 30 September 2026, the Information Commissioner's Office — the body that polices data protection and GDPR in the UK — becomes the Information Commission. If you run a small business, your first reaction is probably "why do I care?" Fair question. Here's the honest answer.
The boring bit (which is good news)
Your actual legal obligations don't change. Data protection law, breach reporting, everything you're already meant to be doing with customer and staff data — all exactly the same on 1 October as it was on 29 September. This is a structural change: the regulator now has a proper board of seven non-executive members overseeing it, rather than one person effectively running the show. No new compliance burden lands on you because of the rename itself.
The only genuinely practical task: if you mention "the ICO" by name in your privacy notice, contracts, or policies, you'll want to update that wording at some point. There's no deadline panic here — do it next time you're updating those documents anyway.
The bit that actually matters for small business owners
Here's the interesting part, and it's not really about the rename. It's about why the regulator is being restructured now: data protection issues involving AI are moving faster than the guidance can keep up with. Specifically — and this is the bit worth paying attention to if you or your team use tools like ChatGPT, Claude, or any AI assistant in your day-to-day work:
- Unauthorised employee use of AI tools is becoming a live data protection issue. If someone on your team is pasting customer details, contracts, or staff information into a free AI chatbot to "save time," that's potentially a data protection breach — and right now, a lot of businesses have no policy on this at all.
- AI agents making decisions or handling data on your behalf are creating new grey areas the regulator hasn't fully addressed yet.
The new Information Commission is expected to move on this — which means clearer rules are coming, but also means scrutiny is coming.
What to actually do
- Update the ICO's name in your policies next time you touch them — no rush, just don't forget.
- Write a one-page AI use policy for your team, even if it's just you and one other person. Cover: what tools are OK to use, what data must never go into a public AI tool (customer records, financial data, anything identifiable), and who to ask if unsure.
- Keep an eye on new AI-specific guidance from the regulator over the next few months — this is exactly the kind of thing that goes from "nobody's watching" to "here's your fine" faster than people expect.
The bigger picture
This is a good reminder that "AI is useful for my business" and "AI is being used safely in my business" are two different things. Most small business owners have said yes to the first without ever properly thinking about the second. A simple, plain-English policy — the kind that takes twenty minutes to write, not a legal team — closes most of that gap.
If you want help putting a proper, non-scary AI-use policy together for your team, that's exactly the kind of thing I help business owners with — get in touch.