Reform UK has pledged to scrap Britain’s GDPR privacy rules and replace them with a more “light-touch” system as Nigel Farage’s party sets out a new pitch to businesses.
The party says the UK’s existing data protection regime places unnecessary burdens on small businesses and technology companies and wants to replace it with rules modelled on New Zealand.
Reform Treasury spokesman Robert Jenrick said Britain should no longer be following privacy legislation inherited from the European Union a decade after the Brexit referendum.
“GDPR has strangled small businesses and tech firms alike in a web of unnecessary regulation,” Jenrick said.
The proposal could have significant consequences beyond businesses dealing with paperwork.
UK GDPR provides people with rights governing how companies, political parties, public bodies and other organisations can collect and use their personal information.
Those include rights to find out what information an organisation holds about you, correct inaccurate information, request deletion in certain circumstances and object to some uses of your data.
Reform has not proposed abandoning data protection altogether.
Instead, it says it wants Britain to adopt a less restrictive regime based on the system operating in New Zealand.
What would Reform replace GDPR with?
Reform says its proposed system would be the “lightest-touch regime” that could still be considered adequate by the European Union.
That qualification is important.
The EU currently recognises Britain’s data protection regime as providing an adequate level of protection for personal information.
It allows personal data to move relatively freely from countries in the European Economic Area to organisations in Britain without businesses having to introduce additional safeguards for each transfer.
Britain’s EU adequacy status was renewed in December 2025 and currently runs until December 2031.
The European Commission continues to monitor changes to British data protection law.
Reform therefore appears to be trying to strike a balance: significantly reducing regulation without making Britain’s rules so different that businesses encounter new barriers when transferring information between Britain and Europe.
Exactly what that would mean for individual privacy rights remains unclear.
The party has not yet published detailed replacement legislation setting out which UK GDPR protections would remain.
What rights does GDPR currently give you?
Despite its association with website cookie notices and consent forms, GDPR extends considerably further than the pop-ups people encounter online.
The rules govern how personal information is collected, stored, shared and processed.
People can ask organisations for copies of information held about them through subject access requests.
They can request that inaccurate information is corrected and, in certain circumstances, ask for information to be deleted.
There are also protections governing automated decision-making and people’s ability to object to particular ways in which their information is processed.
The UK has already changed parts of its post-Brexit data regime.
The Data (Use and Access) Act 2025 introduced changes intended to make some rules easier for organisations while allowing greater use of data and automated decision-making.
However, that legislation did not abolish UK GDPR.
Reform wants to go substantially further by replacing the framework itself.
Reform currently operates under GDPR
There is an interesting consequence for Reform itself.
The party’s own privacy notice currently makes extensive use of the protections it now proposes replacing.
Reform’s policy, updated in July, states that the party processes information under UK GDPR, the Data Protection Act 2018 and other British privacy legislation.
It tells supporters, donors, members, volunteers and website users that their information should be processed lawfully, fairly and transparently.
The party also currently recognises rights including access, rectification, erasure, data portability and objections to certain forms of processing.
Its privacy notice states: “Reform UK recognises that personal information belongs to the individual, not to the organisation processing it.”
That does not necessarily contradict Reform’s new policy. Until Parliament changes the law, the party is legally required to operate under the existing regime.
But it illustrates the range of protections that would have to be addressed if a Reform government replaced UK GDPR.
Labour attacks Reform proposal
Labour has accused Reform of threatening important privacy safeguards.
A Labour spokesperson said the party wanted to “scrap vital safeguards that protect people’s private data”, describing the proposals as “unworkable and unserious”.
The Conservatives have also criticised Reform’s wider economic package.
Shadow chancellor Mel Stride said there was insufficient detail explaining how the GDPR proposal would operate.
The debate is likely to focus particularly heavily on artificial intelligence.
Technology and AI companies process enormous quantities of information, and Reform believes reducing regulation could make Britain more attractive to businesses developing new technologies.
Critics are likely to question whether making it easier for companies to process information could weaken people’s ability to control how their personal data is used.
Reform argues the existing balance has gone too far in the other direction and is holding British businesses back.
Reform launches new business pitch
Scrapping GDPR forms part of a much wider attempt by Farage’s party to strengthen its economic offering.
Reform is also proposing changes to the Seed Enterprise Investment Scheme.
Under its plan, parents and grandparents investing in businesses started by their children or grandchildren could put in up to £250,000 and qualify for a 50% income tax rebate, alongside an exemption from capital gains tax if they retain their investment for three years.
The party has previously promised to increase the turnover threshold at which businesses must register for VAT from £90,000 to £150,000.
It also wants to remove income tax from overtime and reverse increases in employers’ National Insurance contributions.
Farage said Reform wanted to “unchain British enterprise”.
The party will hold its first dedicated business day at its conference in Birmingham next week as it attempts to build stronger relationships with company executives.
For businesses frustrated by GDPR compliance, Reform’s latest proposal offers the prospect of substantially lighter regulation.
For everyone whose information those companies hold, however, the important detail is still missing.
Reform has said what it wants to abolish.
It has yet to spell out precisely which of the privacy rights Britons currently possess would exist under the system replacing it.
Leave a Reply