Information Commissioner’s Office (ICO)


Data protection laws in the UK are regulated and enforced by the Information Commissioner, whose role is set out in Part 5 and Schedule 12 of the DPA 18 (which implements Articles 57 and 58 of the UK GDPR). Their duties are delegated to the Information Commissioner’s Office (ICO), an independent body with a head office in England and offices in Scotland, Wales and Northern Ireland.


In 2023, the ICO brought out online guidance on individual topics in its Employment practices and data protection series: monitoring at work (October 2023). Its guidance, Information about workers’ health was updated in March 2024. And its Guidance on AI and data protection was updated in March 2023. The ICO brought out new guidance on Employment practices and data protection: keeping employment records in February 2025. The guidance is updated on an ongoing basis.


The ICO’s Video surveillance guidance covers the use of CCTV, body worn video and facial recognition technology and includes guidance for employers who use such monitoring techniques. Local authorities in England and Wales who operate surveillance cameras in a public place must also comply with the Protection of Freedoms Act 2012. There are separate laws and guidance for the use of surveillance in connection with law enforcement.