The Information Commissioner’s Office (ICO) has published a consultation on new guidance about its investigation and enforcement procedures, intended to provide organisations with greater clarity and certainty about how the ICO exercises its powers.

The draft guidance is comprehensive, covering each stage of an investigation – from how the ICO decides whether to open one in the first place, through to the procedure for issuing penalty notices. Whilst much of its contents will be familiar to many, it will no doubt be helpful to have such information all in one place, clearly set out, and updated to reflect the changes in the ICO’s conduct and powers since the previous guidance in this area, which dated from 2018.

Taking each stage in turn, the ICO outlines the sources of potential investigations and the factors it considers when deciding whether to open one, ranging from the risk of harm to people by the data processing in question to the resource implications and risks involved in opening an invesitgtaion. The guidance also sets out the information gathering process and what steps the ICO might take to resolve an issue through means other than opening than an investigation.

The guidance then proceeds to set out what organisations can expect if an investigation is opened, including the form and content of a case opening letter and when they can expect the investigation to be announced publicly (unless “exceptional cases” demand otherwise). The ICO also discusses how it will use its information gathering powers during an investigation, covering matters such as when it will issue assessment or interview notices, as well as how it ensures that it does not exceed the limits of its powers as set out in statute.

Finally, the guidance explains what happens after an investigation is concluded and what steps the ICO may take. This includes the process for giving warnings or reprimands, what factors will go into determining whether to issue enforcement or penalty notices, and when it might be deemed appropriate to settle an investigation.

The consultation closes on 12 January 2026 and the draft guidance can be read in full here.