The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

For organisations

Find out about your obligations and how to comply, including protecting personal information, and providing access to official information.

folders on a shelf

Guide to Data Protection

Find out about your obligations under the DPA 2018 and the UK GDPR, including law enforcement processing.

Guides to the legislation

Find out about your obligations and how to comply under the Acts.

Guide to the UK General Data Protection Regulation (UK GDPR)

The GDPR, as it applies in the UK. It applies to most UK businesses and organisations.

Electronic communications and marketing

Sending marketing messages by phone, fax, email or text? Using cookies? Providing electronic communications services to the public? Find out what you need to do to comply.

Freedom of information

If you are a public authority you have a legal obligation to make official information available under the Freedom of Information Act.

ICO codes of practice

Find our all our statutory codes including the Children's Code and data sharing code.

Key data protection themes

Find information here about artificial intelligence, children, political campaigning, direct marketing, video surveillance and other key themes.

Guide to Data Protection

Find out about your obligations under the DPA 2018 and the UK GDPR, including law enforcement processing.

Data Protection and the EU

Understand the implications for organisations and how to plan ahead

Guide to LE Processing

Data protection guidance for organisations with law enforcement functions, including police, justice and surveillance organisations.

Guide to Intelligence Services processing

Data protection guidance for the intelligence services.

Environmental information

Find out your obligations for environmental information.

Guide to Binding Corporate Rules

Binding Corporate Rules (BCRs) provide adequate safeguards for making restricted transfers.

eIDAS

If you provide trust services such as electronic signatures, electronic time stamps and website authentication certificates, you have obligations under eIDAS.

The Guide to NIS

Some digital service providers have obligations under the Network and Information Systems Regulations 2018.

Spatial information

If you are a public authority that holds spatial data, you have a legal obligation to make that information available.

Re-use of information

Find out about your obligations around the re-use of public sector information, and the ICO’s role.

Personal data in political campaigning

This guidance highlights the importance of processing personal data in compliance with data protection law during political campaigning.

Resources and support

Improve and promote information rights practices in your organisation