Reform UK wants to scrap the UK GDPR and copy New Zealand’s privacy law

Reform UK wants to abolish the UK GDPR. It would replace the regime with a lighter privacy law modelled on New Zealand’s. Nigel Farage and the party’s economy chief Robert Jenrick announced the pledge on Tuesday evening, inside a package aimed at small businesses.

Mizy Clifton reported the plan for Politico. Britain wrote an amended version of the EU regulation into domestic law after Brexit, and Reform now wants that unwound.

Farage put it in the language of rescue. “Small businesses are the beating heart of our economy, yet they have been suffocated by years of punishing taxes, suffocating EU red tape and a big-state obsession that rewards dependency over hard work,” he said in remarks carried by the PA news agency.

Jenrick was blunter about the regulation itself. “GDPR has strangled small businesses and tech firms alike in a web of unnecessary regulation,” he said. “Ten years after the Brexit referendum, we should not still be following ridiculous EU privacy laws that hurt British businesses,” Jenrick added.

What the New Zealand model actually is

The gap between the two regimes is mostly about enforcement. Britain’s Information Commissioner can issue multi-million-pound fines. New Zealand’s Privacy Act 2020 caps penalties at NZ$50,000, as The Register noted.

The rights differ too. The EU regulation gives individuals a wider set of them, including the right to be forgotten. The New Zealand law does not match that. On the mechanics of handling and transferring data, the two regimes sit closer than the rhetoric suggests.

The UK GDPR replaced the pre-Brexit Data Protection Act 2018 in 2021. Its European twin is the instrument behind the enforcement most readers will recognise. Dutch regulators used it to fine Uber 825m euros over automated driver suspensions this month.

British readers have seen what the regime catches at home too. NHS England admitted in July that its paperwork hid a disclosure about who could see identifiable patient data. Meta’s employee tracking tool collected EU data it had said it would not collect.

The adequacy problem

Reform says the change would not cost Britain its EU data adequacy status. That status is what lets personal data move between the UK and the bloc without extra legal machinery, and Brussels extended it until 2031 in December.

The Commission grants adequacy only to countries offering an essentially equivalent level of protection. Any major divergence puts the decision at risk. Reform’s press release asserts that the New Zealand model clears that bar. It does not explain how.

The stakes are practical. British firms that lose free data flows to Europe fall back on standard contractual clauses. That is paperwork, and every small business in Reform’s package would pay for it.

Britain has already diverged once

Labour got there first, in a smaller way. The Data (Use and Access) Act passed last year. It loosened parts of the UK GDPR, easing data sharing between critical sectors and softening rules on automated decision-making.

That law kept adequacy intact. It also paved the way for a digital ID rollout, which is a separate argument.

Reform is being sued under the law it wants to scrap

The Good Law Project sued Reform UK in March 2025. It claims the party failed to comply with the UK GDPR. Reform refused to tell people what data it held about them, the campaign group says, and did not answer requests to delete it.

Reform tried to have the case thrown out. A High Court judge ruled in June that it should proceed to trial. Reform UK did not respond to The Register’s request for information about its pledges.

The rest of the package

Reform is not the only party rewriting UK internet rules. The government dropped plans to restrict VPNs in July, and is preparing to bar under-16s from social media. The direction of travel in Westminster is towards more regulation of data, not less.

Scrapping GDPR sits inside a broader list. Reform would reverse the National Insurance increase announced in 2024 by then-chancellor Rachel Reeves. It would scrap income tax on overtime pay for full-time workers, which it calls a hard work bonus.

There is more. The party would loosen inheritance tax on farms and raise the VAT registration threshold from £90,000 to £150,000. It would make the Seed Enterprise Investment Scheme more tax-efficient for parents investing in their children’s businesses. It would also scrap the 2035 Zero Emission Vehicle mandate.

Jenrick put a number on the constituency. “Reform UK believes the 6 million small businesses in the UK are the backbone of our high streets and our economy, and we will back them to the hilt,” he said.

What the other parties said

A Labour spokesperson called the pledges “unworkable and unserious”. The party also accused Reform of trying to undo the Online Safety Act. It said the announcement was a distraction from Farage accepting a £5m gift from an overseas donor.

Shadow chancellor Sir Mel Stride said the pledges “collapse on contact with reality” and would cost billions to implement. On the data plan specifically, he said there is little detail on how scrapping GDPR would work.

He has a point on detail. Reform has published few technology policies beyond a general ambition to make Britain a leader in emerging fields such as AI. It has not said which regulator would enforce the replacement, or with what powers.

Two tests will settle this. The first is whether Reform ever publishes a draft of the light-touch law. The second is whether the European Commission says anything about adequacy before the next election. That is the only opinion on this proposal carrying a legal consequence.