Regulators and enforcers map
The UK regulatory web for information law: who regulates what, who prosecutes, where appeals go, and which other regulators touch the same activity. Lines are recorded relationships; hover one for its basis.
Regulator Prosecutor Tribunal or court Oversight or forum Membership
Information Commission
RegulatorUK-wide regulator for data protection and PECR, and for FOIA 2000 and EIR 2004. Succeeded the Information Commissioner on 2026-09-30.
- Leads on
- UK GDPR and DPA 2018; PECR; FOIA 2000; EIR 2004; Prosecution of DPA 2018 offences in England, Wales and Northern Ireland
- Instruments
- UK GDPR, DPA 2018, PECR, DUAA 2025, FOIA 2000, EIR 2004
- Where
- England and Wales, Scotland, Northern Ireland
- Relationships
-
- Appeals go to First-tier Tribunal (General Regulatory Chamber). Notices and FOI decisions are appealed to the First-tier Tribunal.
- Member of Digital Regulation Cooperation Forum. Coordinates digital regulation with the CMA, Ofcom and the FCA.
- Overlaps with Investigatory Powers Commissioner's Office. Shares oversight of intelligence services processing under Part 4 DPA 2018.
- Overlaps with Ofcom. Overlaps on children's online services: the Age Appropriate Design Code and the Online Safety Act.
- Website
- ico.org.uk
Scottish Information Commissioner
RegulatorRegulator for FOISA 2002 and the EIRS 2004 for Scottish public authorities. No data protection role.
- Leads on
- FOISA 2002; EIRS 2004
- Instruments
- FOISA 2002, EIRS 2004
- Where
- Scotland
- Relationships
-
- Appeals go to Court of Session. Decisions are appealed on a point of law to the Court of Session.
- Website
- www.foi.scot
Investigatory Powers Commissioner's Office
OversightOversight of investigatory powers, sharing oversight of Part 4 DPA 2018 intelligence services processing.
- Leads on
- Investigatory Powers Act 2016 oversight
- Instruments
- DPA 2018
- Where
- England and Wales, Scotland, Northern Ireland
- Website
- www.ipco.org.uk
First-tier Tribunal (General Regulatory Chamber)
Tribunal or courtHears information rights appeals against the regulator's notices and decisions.
- Leads on
- Information rights appeals
- Instruments
- DPA 2018, PECR, FOIA 2000, EIR 2004
- Where
- England and Wales, Scotland, Northern Ireland
- Relationships
-
- Appeals go to Upper Tribunal (Administrative Appeals Chamber). Onward appeal on a point of law, as in the Clearview AI case.
- Website
- www.gov.uk/courts-tribunals/first-tier-tribunal-general-regulatory-chamber
Upper Tribunal (Administrative Appeals Chamber)
Tribunal or courtAppeals from the First-tier Tribunal on points of law in information rights cases.
Court of Session
Tribunal or courtScotland's supreme civil court. Hears appeals on points of law from the Scottish Information Commissioner, and data protection compensation claims in Scotland.
- Leads on
- FOISA appeals on points of law
- Instruments
- FOISA 2002, UK GDPR
- Where
- Scotland
Crown Office and Procurator Fiscal Service
ProsecutorProsecutes crime in Scotland, including DPA 2018 offences committed there.
- Leads on
- DPA 2018 offences in Scotland
- Instruments
- DPA 2018
- Where
- Scotland
- Relationships
-
- Prosecutes for Information Commission. Prosecutes DPA 2018 offences committed in Scotland.
Director of Public Prosecutions (Crown Prosecution Service)
ProsecutorCan bring, or consent to, DPA 2018 prosecutions in England and Wales (s.197).
- Leads on
- Consent to DPA 2018 prosecutions in England and Wales
- Instruments
- DPA 2018
- Where
- England and Wales
- Relationships
-
- Prosecutes for Information Commission. Brings, or consents to, DPA 2018 prosecutions in England and Wales alongside the regulator (s.197).
Ofcom
RegulatorCommunications regulator and the online safety regulator under the Online Safety Act 2023. Does not enforce PECR, which sits with the Information Commission.
- Leads on
- Online Safety Act 2023; Communications networks and services
- Where
- England and Wales, Scotland, Northern Ireland
- Relationships
-
- Member of Digital Regulation Cooperation Forum. Member of the Digital Regulation Cooperation Forum.
Competition and Markets Authority
RegulatorCompetition and consumer protection, including digital markets. Data practices can raise consumer law issues alongside data protection ones.
- Leads on
- Competition and consumer law; Digital markets
- Where
- England and Wales, Scotland, Northern Ireland
- Relationships
-
- Member of Digital Regulation Cooperation Forum. Member of the Digital Regulation Cooperation Forum.
Financial Conduct Authority
RegulatorConduct regulator for financial services. Firms' data handling can engage FCA rules as well as data protection law.
- Leads on
- Financial services conduct
- Where
- England and Wales, Scotland, Northern Ireland
- Relationships
-
- Member of Digital Regulation Cooperation Forum. Member of the Digital Regulation Cooperation Forum.
Digital Regulation Cooperation Forum
ForumCooperation forum of the CMA, FCA, Information Commission and Ofcom. Coordinates; it has no enforcement powers of its own.
- Leads on
- Coordination between digital regulators
- Where
- England and Wales, Scotland, Northern Ireland