Regulator profile

ICO

Information Commissioner's Office

Enforcement Regulator UK-wide

What ICO does

Data protection, freedom of information, privacy and electronic communications regulation. Enforces UK GDPR and Data Protection Act 2018. Issues fines for breaches. All businesses processing personal data must pay ICO data protection fee.

Data ProtectionFreedom Of InformationPrivacy

Contact ICO

Official guidance from ICO

Curated guidance documents to help you understand your obligations.

Pay the data protection fee (opens in a new tab)

Detailed Guidance

Direct marketing guidance (ICO) (opens in a new tab)

Detailed Guidance

Key concepts and definitions (opens in a new tab)

Detailed Guidance

Toolkits (opens in a new tab)

Detailed Guidance

Fines and why they happen (opens in a new tab)

Detailed Guidance

What is NIS? (opens in a new tab)

Detailed Guidance

ICO AI and data protection guidance (opens in a new tab)

Detailed Guidance

UK GDPR guidance (ICO) (opens in a new tab)

Detailed Guidance

View all 1122 guidance documents (opens in a new tab)

Legislation that ICO directly enforces.

Primary legislation

Freedom of Information Act 2000 Data Protection Act 2018 Investigatory Powers (Amendment) Act 2024 Data Use and Access Act 2025 Data Use and Access Act 2025

Secondary legislation

Electronic Commerce (EC Directive) Regulations 2002 Privacy and Electronic Communications Regulations 2003 Environmental Information Regulations 2004 Freedom of Information (Fees and Appropriate Limit) Regulations 2004 INSPIRE Regulations 2009 The Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 The Data Protection (Monetary Penalties) Order 2010 The Freedom of Information (Time for Compliance with Request) Regulations 2010 Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 The Data Protection Act 1998 (Commencement No. 3) Order 2011

… and 56 more statutory instruments.

Legislation connected to ICO’s remit but not directly enforced — establishing Acts, amendments, referenced legislation, and context.

Administered / monitored

Data Protection (Processing of Sensitive Personal Data) Order 2000 UK Statutory Instrument Public Contracts Regulations 2015 UK Statutory Instrument Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 UK Statutory Instrument Data Protection, Privacy and Electronic Communications (Amendments ) (EU Exit) Regulations 2019 UK Statutory Instrument Procurement Regulations 2024 UK Statutory Instrument DUAA 2025 (Commencement No. 6) Regulations 2026 UK Statutory Instrument

← All regulators