Paul Arnold MBE's opening speech at DPPC 2026

Paul Arnold MBE, Chief Executive Officer at the ICO, spoke at the opening of DPPC 2026.

Morning everyone.

If there's one thing I want you to know, it's that the partnership between the thousands of people joining us today and the ICO has never been more important.

New technologies and changing societal norms bring unprecedented opportunities. But unprecedented risks.

We have a moment to harness that potential. But we must do so safely and we must do so together.

The extent of the uncertainty facing those in this room has never existed at such scale or such pace. Whether you're a small business, a government department, a multinational or a charity, your job has never been harder or more important. And neither has ours at the ICO.

I stand here today just two weeks after the launch of the new Information Commission. An organisation with more robust governance and a longer-term perspective on the challenges we face together. I'm extraordinarily proud to be the Chief Executive of the Information Commission and we are joined in the audience by some of our new Board members today. But I'm even more proud to lead such a brilliant and dedicated ICO team.

We are an organisation evolving to meet the moment. And how we do that together is exactly what today is all about.

I know building trust in the way your organisations use data and innovate is central to all your roles. Without public trust your progress is slow or temporary.

When I think about public trust and the apparent tension between protecting people and enabling responsible organisations to innovate, I don't see them as incompatible. In 2026, I see them as mutually dependent and reinforcing.

If people are to safely benefit from new and innovative products and services intended to improve lives, we need those same products and services to enhance rather than erode privacy. That calls for innovation as the foundation of modern safeguards and protection.

But that's enough theory. Today is about practice. So, what does that mean for you and your relationship with the ICO?

As data and information governance professionals, we want to make sure you are supported to establish the core data governance foundations you need and that you have the clarity from the regulator when supporting your organisations to innovate responsibly.

Our role is to make sure that the right behaviours are in place in organisations across the UK to build public trust in responsible data use and innovation.

How we will do that is grounded in humility and in outcomes. In a real-world understanding of both the risks and the opportunities. And in a genuine commitment to supporting the people here today to navigate them.

For example, our fantastic Data Protection Essentials tool designed to help small organisations across the UK get the essentials right and avoid unnecessary risk aversion. This launched earlier this year and I couldn't be more pleased with the progress and the feedback. If you haven't heard of it, then check it out later today.

At the other end of the scale, we have launched a consultation on agentic AI. Ahead of producing our code of practice on AI and automated decision-making, we want and need to hear from those already using or keen to use this technology. We want your experiences to shape our work, so please do contribute if you are able.

Whether we are achieving our outcomes through guidance, communication, engagement or enforcement, our commitment is to a proportionate, transparent approach that is fair to all those we regulate and protects the public. Examples like Data Protection Essentials or our AI code are focused on encouraging the right behaviours.

But enforcing the law is important. Where we encounter criminal, negligent or irresponsible practices that are undermining the efforts made by hard-working professionals like those joining us today, we will use the regulatory tools that are best suited to the job.

That won't be in secret. We will be transparent about the difficult choices we are taking and the impact we believe our interventions are making.

But we are open to conversation. Open to challenge.

If you think we are doing a good job then we'd love you to tell us. If you think there is more we should be doing then we want to hear that too. And if you are concerned by any decisions we have taken, actions we have taken or not taken, then we really want to hear that too. So please do contact us through whatever channel works best for you.

The work we do is complex and it cuts through our whole economy and touches all parts of our society. We have a key role to play but often that will be just one part of a much broader ecosystem. We want to be a regulator that works with, alongside and for our stakeholders and the public we are here to protect.

That is the Information Commission we are building.

But today is not about us, it's about you. What you need. What would help. Whether you are here to better understand how to manage cyber risk, to safely deploy AI, to respond effectively to subject access requests or simply to feel more confident in the work you do every day, we are here to help.

I want you to leave today feeling clearer. More confident and inspired. Knowing that you are not facing these challenges alone.

Our brilliant team is out in force today working to make this another fantastic DPPC event. So please enjoy the day the team have planned for you, enjoy connecting with one another and let's look forward to what we are able to achieve together.

Thank you.