Welcome to the annual report of the Information Commissioner's Office for 2025/26.

It is rare in the ICO’s 42-year history that an annual report represents such an important ending and critical new beginning. As we transition to the new Information Commission, we are stepping into a new era, and this report sets out the work that has laid the foundations for what comes next.

It might be the profile behind an algorithm deciding whether someone gets a loan or a job interview. It could be the trace left by a child scrolling through social media. It may be a life-changing medical diagnosis made possible through research. How data is used has very real consequences for people's lives.

Throughout 2025/26, the ICO has demonstrated what it means to prioritise impact with those consequences in mind. That means every decision taken reflecting the real harms people face, the genuine opportunities to use data responsibly and the places where our intervention can drive lasting change.

We have continued our focus on keeping children safe online, holding online service providers to account through a range of regulatory tools, including fines to Imgur and Reddit. We have seen major platforms strengthen their data protection practices, improving the online privacy of over 11 million children. This work puts us at the forefront of one of the most important challenges society faces in 2026.

We continue to support those who need our help. Our work to champion the records of care-experienced people recognised that for those who have grown up in the care system, personal records are not simply data: they are identity, history and belonging. And our firm action taken against companies using sophisticated robocall technology was a step towards protecting elderly and at-risk people from deception and exploitation. Our cookie compliance work has brought 979 of the top 1,000 UK websites into compliance, giving an estimated 40 million people – around 80% of UK internet users over the age of 14 – genuine control over how they are tracked online.

On artificial intelligence, we are providing the regulatory certainty that responsible AI development needs, while ensuring we can pivot where new use cases call for scrutiny. This year has seen the launch of our AI and biometrics strategy and plans for a new statutory code of practice that will give businesses a single, clear set of rules for developing and using AI products responsibly.

Our enforcement work sits alongside that support. This year, a critical transformation programme has modernised our approach to identifying and selecting the most appropriate regulatory interventions to achieve behaviour change proportionate to risks and opportunities. Our pipeline of enforcement activity has become more focused in response, alongside our impact. Fines issued this year have sent a clear signal about the consequences of poor data security, while our work through the courts has reaffirmed that companies seeking to monitor UK residents cannot place themselves beyond the reach of UK data protection law.

Across our work, we are a regulator that enables as well as enforces. Our activities are estimated to have generated around £233 million of economic value for UK businesses over five years. The work described in this report provides the platform for our upcoming corporate strategy, which focuses on building trust in responsible UK data use and innovation. 

The new Information Commission will bring greater governance resilience and broader strategic leadership. Our priorities and our focus remains, as always, on the areas which make the greatest difference to people’s lives. This is what guides our efforts and the Information Commission will continue to champion people’s information rights.

None of this is possible without the people who work here. Behind every statistic and case study in this report is a team of dedicated professionals who care deeply about making a difference and have responded to unique challenges with professionalism and focus. My thanks go to each of them and to the Management Board for the thoughtful stewardship they have provided throughout this year of change and transition.

The work ahead is significant and there remains much to do. But the organisation stepping into it is ready to embrace the challenge of building trust in the digital world around us.

Paul Arnold MBE
13 July 2026