Reform UK aims to eliminate the UK GDPR and adopt New Zealand’s privacy legislation as a model.

      Reform UK aims to eliminate the UK GDPR and replace it with a more lenient privacy law inspired by New Zealand’s model. Nigel Farage and Robert Jenrick, the party's chief on economic matters, revealed this commitment on Tuesday evening as part of a broader initiative targeting small businesses. Mizy Clifton reported the development for Politico. Following Brexit, the UK incorporated a modified version of the EU regulation into its domestic law, and Reform seeks to reverse that.

      Farage referred to the situation as a rescue effort, stating, “Small businesses are the lifeblood of our economy, but they have been overwhelmed by burdensome taxes, excessive EU red tape, and a large state mentality that favors dependency over diligence,” according to the PA news agency.

      Jenrick was more straightforward regarding the regulation. “GDPR has hindered small businesses and tech companies with an unnecessary web of regulations,” he commented. “A decade after the Brexit referendum, we should not still be adhering to absurd EU privacy laws that disadvantage British businesses,” he added.

      Understanding the New Zealand model

      The main difference between the two frameworks lies in enforcement. The UK’s Information Commissioner has the authority to impose fines amounting to millions, while New Zealand’s Privacy Act 2020 limits penalties to NZ$50,000, as noted by The Register.

      The rights conferred also differ. Individuals under the EU regulation enjoy a broader array of rights, including the right to be forgotten, which is absent in New Zealand's law. However, in terms of data handling and transfer mechanics, the two regimes are more similar than they might appear.

      The UK GDPR took the place of the pre-Brexit Data Protection Act 2018 in 2021. The EU's equivalent is well-known, with Dutch regulators recently fining Uber 825 million euros related to automated driver suspensions.

      British audiences have observed the implications of this regime domestically as well. In July, NHS England admitted to concealing a disclosure regarding who could access identifiable patient data. Additionally, Meta’s employee tracking tool gathered EU data that it had claimed it would not.

      The adequacy issue

      Reform asserts that altering the law would not jeopardize Britain’s EU data adequacy status, which allows personal data to be exchanged with the bloc without additional legal requirements. This status was renewed by Brussels until 2031 in December.

      The Commission only grants adequacy to countries that provide an essentially equivalent level of protection, meaning any significant deviation could threaten this status. Reform's press release argues that the New Zealand model meets this criterion, but does not provide details on how.

      The practical implications are significant. If British businesses lose free data access to Europe, they must rely on standard contractual clauses, leading to additional paperwork that every small business in Reform’s proposal would have to bear.

      Britain has already made a deviation

      Labour was the first to initiate changes, albeit on a smaller scale. The Data (Use and Access) Act, which passed last year, relaxed certain aspects of the UK GDPR by facilitating data sharing across essential sectors and easing automated decision-making regulations. This law maintained adequacy and also set the groundwork for a digital ID rollout, which is a separate issue.

      Reform is currently facing legal action related to a law it intends to abolish

      In March 2025, the Good Law Project filed a lawsuit against Reform UK, claiming non-compliance with the UK GDPR. The campaign group alleges that the party did not disclose the data it held on individuals or respond to requests for deletion.

      Reform sought to dismiss the case, but a High Court judge ruled in June that it should go to trial. Reform UK has not replied to The Register's inquiry regarding its proposals.

      The broader initiative

      Reform is not the sole party altering UK internet regulations. The government has abandoned plans to limit VPNs and is working on prohibiting social media access for individuals under 16. Overall, the trend in Westminster seems to be towards increased regulation of data rather than less.

      The proposal to abolish GDPR is part of a wider agenda. Reform seeks to reverse the National Insurance increase announced in 2024 by former Chancellor Rachel Reeves, eliminate income tax on overtime for full-time workers (referred to as a hard work bonus), relax inheritance tax on farms, and raise the VAT registration threshold from £90,000 to £150,000. It also aims to make the Seed Enterprise Investment Scheme more tax-efficient for parents funding their children's businesses and to eliminate the 2035 Zero Emission Vehicle mandate.

      Jenrick highlighted the significance of small businesses: “Reform UK believes the 6 million small businesses in the UK form the backbone of our high streets and economy, and we will fully support them,” he stated.

      Reactions from other parties

      A spokesperson for Labour criticized the pledges as “unworkable and unserious,” accusing Reform of attempting to dismantle the Online Safety Act and claiming the announcement diverted attention from Farage’s acceptance of