Summary

  • The Board’s £1 million approval line covers unbudgeted contracts, projects and commitments; budgeted commitments hit a £5.2 million threshold in 2026/27.
  • The Board decides strategy and reserved spending collectively. The CEO runs operations and remains personally accountable to Parliament as Accounting Officer for public money.
  • Deputy Chair Maggie Carver is carrying the Chair’s responsibilities while government recruits a permanent Chair, with the process expected to conclude in spring 2027.

Power moved to a Board; the public-money answer still has a name

The Information Commission has changed who gets to decide on its largest unbudgeted commitments. More than £1 million goes to the Board; day-to-day decisions stay with the CEO. Yet Parliament still has one named Accounting Officer: that same CEO, personally accountable for regularity, propriety and value for money in the use of public resources.

That split is where institutional design meets the public. The ICO says its core responsibilities and public services continue under the new Information Commission. The new rules determine which decisions supporting that work reach collective scrutiny, who runs delivery and who must explain how public money was used.

A million-pound commitment changes who has to say yes

An unbudgeted contract, project or financial commitment worth more than £1 million now reaches the Information Commission Board for approval. A budgeted commitment has a higher threshold: more than £5.2 million in 2026/27. The Board can also reserve a commitment at any value if its strategic, financial or reputational impact makes it significant. The Board’s new terms of reference set these limits.

The thresholds sit inside a larger change. On 30 September, the Information Commissioner’s Office formally transitioned to the Information Commission. The ICO says the Data (Use and Access) Act 2025 moved it from a corporation sole — one Commissioner — to collective decision-making by a Board. The regulator’s core responsibilities and public services continue.

The Board’s terms of reference put strategy, annual priorities, budget, risk appetite, governance arrangements and major commitments on its side of the line. It also appoints and oversees the CEO, approves the annual report to Parliament and controls the scheme that delegates authority. The document is unusually concrete about money: above 5% of annual income for budgeted commitments, above 1% for unbudgeted ones, with separate room for commitments judged significant by their effects.

The executive side is just as explicit. The Board delegates operational decisions and delivery to the CEO. The CEO must bring significant or apparently significant financial, legal, reputational or operational risks and opportunities to the Board promptly, as well as matters outside an approved delegation or where authority is unclear. Doubt goes to the Chair or Deputy Chair.

That is a governance chart with consequences for people who deal with the regulator. A major new programme, a large contract or a decision that changes regulatory strategy can no longer be understood only as “the ICO decided”. The terms specify which decisions belong to the collective Board and which belong to management. The Scheme of Delegations says the Board remains accountable overall for delegated decisions, while the CEO is responsible for operations, administrative leadership, management and performance.

The CEO also remains Accounting Officer and is personally accountable to Parliament for regularity, propriety and value for money in the use of public resources. That split leaves two named accountabilities: the Board sets the direction and controls the delegation; the CEO runs the organisation and answers for its operational use of public money.

A board with a deputy, and a chair search still running

The Board is operating with an interim arrangement at the top. The ICO appointed Maggie Carver Deputy Chair as one of its first actions on 30 September. She will perform the Chair’s responsibilities while the government completes recruitment; the ICO expects that process to conclude in spring 2027. The Board page lists the Chair role as under recruitment and publishes the Board’s membership.

The arrangement matters because the Board’s own rules send uncertain matters to the Chair or Deputy Chair. The ICO says Carver is carrying those interim responsibilities. The question for the next stage is how the Board uses its collective powers while that appointment is pending — especially when a matter falls outside a clear delegation or sits below a numeric line but carries strategic or reputational weight.

The transition changes the location of oversight, not the regulator’s stated remit. The ICO says its guidance, advice, enforcement and public services continue. For firms, public bodies and people whose complaints reach the regulator, the practical map is now more legible: the Board owns institutional direction and reserved decisions; the CEO owns day-to-day delivery; the written delegation connects the two.

Sources