New regulator, new rules on pseudonymisation: the fortnight that reset the data privacy agenda

New regulator, new rules on pseudonymisation: the fortnight that reset the data privacy agenda

Week of 21 September 2026 | Compiled by Team Paringa

A week dominated by structural change rather than fines: the UK's data regulator is being rebuilt from the top, the EU is still arguing about when pseudonymised data stops being personal data, and every AI programme touching personal data now has two rulebooks to satisfy at once.

What Happened This Week

🔴 ICO becomes the Information Commission on 30 September, with a new board and a Chair search

On 14 September, DCMS minister Stephanie Peacock made a written statement to Parliament confirming that on 30 September 2026 the Information Commission takes over every function of the Information Commissioner's Office. The ICO published its own confirmation on 15 September and updated it on 17 September to say the organisation will still be known as the ICO in day-to-day use. The legal trigger is the Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026.

The change is more than a rename. The ICO has operated as a corporation sole, with statutory powers vested in one individual. From 30 September it becomes a body corporate with executive and non-executive members and collective responsibility for decisions. Seven non-executive members appointed in July (Laurie Benson, Maggie Carver, Stephen Cohen, Sukhvinder Kaur-Stubbs, Gary Kildare, Hilary Newiss and Scott McPherson) take their seats alongside interim Chief Executive Paul Arnold. The Government has also launched a public appointments campaign for a permanent Chair.

The ministerial statement frames the new structure as being built to "navigate rapid technological change" and "increasingly complex data-driven services". Read alongside the ICO's 17 September blog on smart glasses and public trust, authored by Arnold, the direction of travel is clear: a board-governed regulator with a broader skills base is being positioned to take on AI-era data use, not just breach notifications and nuisance calls.

For UK organisations, the practical consequences are continuity of enforcement powers, no change to UK GDPR obligations, and a regulator that will want to demonstrate early that its new governance produces sharper, faster decisions.

Sources: ICO, UK Parliament written statement via TheyWorkForYou, ICO blog, 17 September

A new board with a public mandate to prove itself is the moment when enforcement priorities get reset. Expect the Information Commission's first year to feature visible action on AI and personal data, because that is where public trust is weakest and where a board can show it matters. CDOs and DPOs should treat the next six months as the window to get AI data flows documented and personal data minimised before the new regime picks its first examples. Organisations that can show personal data is tokenised before it reaches any model or agent will have a much easier conversation than those relying on policy documents alone.

🟡 Digital Omnibus: Council tests new GDPR compromise, pseudonymisation and AI training data still unresolved

On Friday 11 September the Council's Antici Group on Simplification met in Brussels with the Digital Omnibus as its only substantive item, examining a revised Irish Presidency compromise (ST 12535/26) and an explanatory note (WK 13065/26). Both texts remain restricted. The meeting was preparatory, not a general approach or the start of trilogues, and Parliament's ITRE committee still records the file as awaiting a committee decision.

The unresolved issues matter directly to anyone running AI on personal data. The Cyprus Presidency had abandoned the Commission's proposal to clarify the definition of personal data in Article 4 and instead drafted a new Article 29a on pseudonymisation and identifiability. In July, the Irish Presidency asked Member States whether that approach actually delivers legal certainty. The June compromise also removed the Commission's operative provision on processing personal data for AI development and replaced it with a recital stating that such processing "may" constitute a legitimate interest. Member States were asked whether that is enough.

The commentary from Dr Mark Leiser, published 8 September, sets out what is at stake: the CJEU's EDPS v SRB judgment already established that pseudonymised data can fall outside the GDPR for a recipient with no realistic means of re-identification, and the EDPB's July anonymisation guidelines accept that anonymity varies by entity. The question is whether the Omnibus will give organisations a documented, auditable way to rely on that, so that pseudonymisation and privacy-enhancing technologies "purchase a predictable regulatory dividend".

Sources: Dr Mark R Leiser, Digidata, Privacy Next

Whichever way the Council lands, the direction is the same: pseudonymised data handled by a party without the re-identification key is moving towards a lighter regime, and organisations that can prove that separation will get the benefit. That is an architecture decision, not a policy one. Firms that tokenise identifiers at the data layer and keep the vault under separate control are already building the evidence the Omnibus will reward. Firms that pseudonymise inside the same application that holds the lookup table are not.

🟡 EU Data Act access-by-design now live, and DWT spells out why AI Act and GDPR compliance cannot be separated

Two developments this fortnight tightened the design obligations on anyone building data-driven products. From 12 September 2026, connected products and related services placed on the EU market must be designed so users can access the data they generate directly, "easily, securely, free of charge and in a comprehensive, structured, commonly used and machine-readable format", where technically feasible. This moves the Data Act from an access-on-request obligation (live since September 2025) to a product design requirement, and manufacturers will need to separate personal from non-personal data at the point of collection to comply without creating new GDPR exposure.

Separately, Davis Wright Tremaine's September Trust Issues briefing (14 September) lays out how deeply the EU AI Act depends on the GDPR: the AI Act references the GDPR 30 times, refers to personal data 80 times without defining it, borrows the GDPR definitions of special category data and profiling, and requires Fundamental Rights Impact Assessments to complement rather than duplicate DPIAs. Almost every prohibited practice in Article 5 and most Annex III high-risk categories involve personal data. DWT's conclusion is that organisations running AI Act and GDPR compliance as separate programmes "risk noncompliance with both laws", because the same processing can be permitted under one and prohibited under the other.

For context, the Digital Omnibus on AI, adopted in June, pushed the substantive Annex III high-risk regime to December 2027, but transparency obligations and the GPAI rules are already live and the GDPR analysis has to be done regardless of the AI Act timeline.

Sources: Davis Wright Tremaine, Wilson Sonsini, Gaming Tech Law

The common thread is that regulators now expect personal data to be identified, classified and controlled at the point it enters a system, not reconstructed afterwards from a policy. That is the difference between a DPIA that describes intent and one that describes controls. Heads of AI should map every model, agent and connected product against a single data inventory and ask one question: where does personal data actually sit, and who can see it in the clear? If the honest answer is "in the prompt log, the fine-tuning set and the vector store", the fix is at the data layer, and it is cheaper now than after the first enquiry.

What CDOs, DPOs and CISOs Are Dealing With

The enforcement landscape is shifting from breach-and-fine to structure-and-design. The UK is installing a board-run regulator explicitly briefed to handle complex, data-driven services. The EU is rewriting the boundary of personal data around what a recipient can realistically re-identify, and simultaneously requiring products to be built with data access and AI risk controls designed in. None of these changes lower the bar. They change where the bar is measured: in the architecture rather than the privacy notice.

For teams running AI programmes, that means the DPIA, the AI Act risk assessment and the data platform design are now one exercise. The organisations under least pressure are those that can show personal data is minimised, tokenised or pseudonymised before it reaches prompts, training sets, agents or third-party models, with the ability to re-identify held separately. Everyone else is carrying the full weight of two regimes on the same unprotected data.

Three Things Worth Watching Next Week

1. Information Commission go-live on 30 September - Watch the first statements from the new board and interim CEO Paul Arnold for signals on enforcement priorities, and whether AI and children's data are named explicitly.

2. Next Irish Presidency text on the GDPR Omnibus - After the 11 September Antici discussion, a further compromise on Article 29a pseudonymisation and the AI legitimate-interest wording is the item to track. Any move to give pseudonymisation an operative legal effect changes the economics of privacy engineering.

3. Governor Newsom's decision on California SB 690 by 30 September - The bill would end private CIPA website-tracking suits. If signed, it reduces one litigation front for global firms but leaves Attorney General enforcement and the wiretapping provisions untouched.

Questions? hello@paringa.ai

Paringa helps organisations run AI on personal data without exposing it, by tokenising and pseudonymising PII at the data layer with partner Skyflow and wrapping it in a managed governance service that maps to UK GDPR, the EU AI Act and ISO 42001. The evidence regulators now ask for is built into the architecture, not bolted on afterwards. | 21 September 2026 | © Paringa Ltd