ICO’s draft strategy lacks detail

The ICO is currently going through turbulent times. The new non-executive members to the Information Commission have finally been announced, but there is no Chair due to the resignation of John Edwards. The government is recruiting for a Chair, noticeably only for three days a week, as this position will now have a strategic rather than an operational role. It will take some time before the new IC is in place due to the lengthy appointment process led by the government, involving Parliament and finally sealed by the King’s signature.

In June 2025, Paul Arnold, who has worked in various roles at the ICO for decades, was appointed as Interim Chief Executive of the Information Commission, a position which he will formally assume when the transition to the Information Commission takes place. He may serve in that role for a period of up to two years, after which time a recruitment process will be undertaken to fill the role on a permanent basis, the government has confirmed.

It is rather surprising that the ICO has nevertheless issued a skeleton draft strategy for consultation. I am sure I am not alone in thinking that this is extraordinary as the draft strategy has not been authored or approved by the new board. DUAA’s intention is to allow them to develop the ICO’s strategic direction of travel. So will the new board stick with this strategy?

DUAA has provided the government with powers to adopt new adequacy decisions. While the existing adequacy decisions continue to be valid, it has been quiet on this front. The government is now seeking evidence on the important issue of international data transfers to find out from organisations how they are managing this issue. Read an analysis of the UK data transfer framework.

DUAA did not reform Data Subject Access Requests in the way that many practitioners had hoped. New challenges are now posed by AI-generated requests which are very labour-intensive to deal with and highly detailed.

I hope that you will be able to attend our complimentary subscriber event in London on 6 October where current data protection topics will be discussed by some of our stellar regular correspondents. We look forward to meeting you there.

Laura Linkomies
Editor, Privacy Laws & Business

September 2026