FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Professional indemnity explained
The Information Commission is the UK's data protection regulator that replaced the Information Commissioner's Office on 30 September 2026. Its powers are unchanged, but a new complaints duty and data claims affect how professional firms manage risk and insurance.
Part of: Professional indemnity insurance
In short
On 30 September 2026 the Information Commission (formerly the ICO) took over as the UK data protection regulator. The government says its role, responsibilities and powers are unchanged; the difference is a board structure instead of a single Commissioner. The bigger practical change came on 19 June 2026, when a statutory complaints duty started: firms must make complaining easy, acknowledge complaints within 30 days and respond without undue delay. Breach reporting is still within 72 hours where feasible. Fines are often excluded from PI, while civil claims and breach costs may fall to PI or cyber cover, subject to the policy terms.
The short answer: the regulator's name and structure changed, but the law firms must follow did not. On 30 September 2026 the Information Commissioner's Office was replaced by the Information Commission (formerly the ICO). According to the government announcement, the old ICO was a corporation sole, with every statutory power held by one person, the Information Commissioner. The new body is a corporate entity led by executive and non-executive members who share responsibility for decisions.
The same announcement says the transition does not change the regulator's role, responsibilities or powers. The Information Commission still regulates data protection and freedom of information, still issues guidance and still takes enforcement action. The change was made under the Data (Use and Access) Act 2025, which received Royal Assent in June 2025.
For a professional firm, the rename itself is mostly housekeeping. The more important change of 2026 arrived earlier, on 19 June, when a new statutory duty to handle data protection complaints came into force. That duty, and how complaints can turn into claims, is where your professional indemnity insurance and cyber cover come in.
The table summarises the verified changes that matter most to accountants, solicitors, consultants and other professional firms.
| Change | In force | What it means for a firm |
|---|---|---|
| Data (Use and Access) Act 2025 receives Royal Assent | 19 June 2025 | Starts a phased series of commencement regulations |
| Duty to handle data protection complaints (new section 164A, Data Protection Act 2018) | 19 June 2026 | You must make it easy to complain, acknowledge within 30 days and respond without undue delay |
| Information Commission replaces the ICO | 30 September 2026 | Same powers and role; update references in policies and notices |
| Personal data breach reporting (UK GDPR Article 33) | Unchanged timing | Report notifiable breaches to the Commission without undue delay and, where feasible, within 72 hours |
| Penalty for breaching the complaints duty | 19 June 2026 | Falls within the standard maximum penalty band |
The commencement regulations (SI 2026/82) brought section 103 of the 2025 Act fully into force on 19 June 2026. The text of Article 33 now refers to the Commission rather than the Commissioner, but the 72 hour expectation and the risk threshold are the same as before.
Under section 164A, a data subject may complain to the controller about an infringement of the UK GDPR affecting their personal data. The controller must:
Under section 157 of the Data Protection Act 2018, a breach of the complaints duty sits in the standard maximum band: up to £8.7 million or 2 per cent of worldwide annual turnover for an undertaking, whichever is higher. The higher band, for the most serious UK GDPR infringements, is £17.5 million or 4 per cent.
A data complaint from a client is often the first sign of a dispute. If it alleges that your firm mishandled confidential information and asks for compensation, it may already be a claim, or a circumstance that could give rise to one, under your PI policy. Most PI wordings require you to tell insurers promptly, so it is worth reading how circumstance notification works and how cyber and PI notification duties interact before a complaint lands.
Three different kinds of cost can follow a data incident, and they are usually treated differently by insurers:
| Cost | Typical home | Points to check |
|---|---|---|
| Regulatory fines from the Information Commission | Often excluded, or covered only where insurable by law | Insurability of data protection fines in the UK is uncertain; read the fines wording carefully |
| Civil claims by clients or individuals | PI for professional services; cyber for data liability | Whether the PI policy has a cyber or data exclusion, and what it carves back |
| Breach response and investigation costs | Cyber policy; sometimes a PI extension | Forensics, notification, legal advice, and regulatory investigation costs limits |
Our guide to whether fines and penalties are covered by PI and the analysis of GDPR fines and PI implications for professional firms go into this in more depth. For the split between policies, see where cyber cover ends and PI begins. Background figures on reported incidents are in our UK data breach statistics.
Illustrative example 1: misdirected payroll file. A bookkeeping practice emails a client's payroll report to the wrong recipient. The practice assesses the risk, reports the breach to the Information Commission within 72 hours, and an affected employee later demands compensation. The breach response costs would usually fall to a cyber policy, while a claim from the client alleging a failure of professional care could fall under PI, subject to the policy terms.
Illustrative example 2: an ignored complaint. A law firm receives a complaint through its website contact form saying it disclosed a former client's details to a third party. Nobody acknowledges it. The former client escalates to the regulator and instructs solicitors to claim damages. The missed 30 day acknowledgement does not cause the loss, but it makes the dispute harder to resolve and may complicate notification to insurers.
Illustrative example 3: ransomware at a design practice. A small architecture practice suffers ransomware and cannot access drawings for a week. A cyber policy commonly responds to recovery costs and business interruption, while any claim from a client for project delay would be considered under PI. See what to do in the first 72 hours after a cyber breach.
Apex arranges professional indemnity and cyber insurance for professional firms; a broker reads every enquiry.
No. From 30 September 2026 the ICO was replaced by the Information Commission. The government says the regulator's role, responsibilities and powers are unchanged, so it still regulates data protection and freedom of information, issues guidance and takes enforcement action. The main difference is governance: decisions now sit with a board of executive and non-executive members rather than a single Commissioner.
The timing has not. Under UK GDPR Article 33 a controller must report a notifiable personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals. The only change is that reports now go to the Information Commission (formerly the ICO).
Since 19 June 2026, section 164A of the Data Protection Act 2018 requires controllers to make it easy for people to complain, for example with an electronic form, to acknowledge complaints within 30 days, to respond without undue delay and to tell the complainant the outcome. It applies to complaints about UK GDPR infringements affecting the complainant's own data.
Usually you should not rely on it. Many PI policies exclude fines and penalties, or cover them only where insurable by law, and the insurability of data protection fines in the UK is uncertain. PI is more likely to respond to civil claims from clients alleging a breach of professional duty, subject to the policy terms and any cyber exclusion.
Often, yes. PI is designed for claims arising from your professional services, while cyber insurance commonly covers breach response, forensic investigation, data restoration and business interruption. Some PI policies include limited data cover, but the scope varies widely, so ask a broker to compare the two wordings side by side.
Tell us what your business does, your turnover and any claims. A broker reads every enquiry and comes back with options. No fee for a quote. Or call 0117 325 0027.
Start a commercial enquiry Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
