Reform UK’s Proposal: Scrapping UK GDPR for New Zealand’s Privacy Law
Reform UK has pledged to abolish the UK General Data Protection Regulation (GDPR) and replace it with a light-touch law modelled on New Zealand’s, where the maximum fine is NZ$50,000. The party believes this change will preserve EU (read more here) data adequacy. Notably, they are currently facing a lawsuit under the very regulation they aim to scrap.
Background
- August 31, 2026: Reform UK leader Nigel Farage announces the pledge, aiming to benefit small businesses.
- Key Figures:
- Nigel Farage: "Small businesses are the beating heart of our economy… [GDPR] has strangled… tech firms alike."
- Robert Jenrick: "GDPR… hurts British businesses… [New Zealand law] will not cost us data adequacy."
The New Zealand Model
The proposed change focuses on enforcement and rights. While the UK GDPR allows for multi-million-pound fines, New Zealand’s Privacy Act 2020 limits penalties to NZ$50,000. In terms of rights, while the EU regulation offers a broader set (including the right to be forgotten), the New Zealand law does not include these specific provisions.
Technical Similarities and Data Adequacy
Despite differences in enforcement and rights, the two regimes share similarities in data handling and transfer mechanics. The UK GDPR replaced the pre-Brexit Data Protection Act 2018 in 2021, with its European counterpart enabling significant enforcement actions, such as an $825m fine on Uber by Dutch regulators.
Adequacy Concerns
Reform UK claims the New Zealand model will not jeopardize Britain’s EU data adequacy status, which was extended until 2031. However, they have not provided detailed explanations of how this divergence would be managed. Currently, British firms relying on standard contractual clauses face additional costs as a result of these regulatory differences.
Historical Context
This proposal is not the first divergence from GDPR in the UK. In 2022, Labour’s Data (Use and Access) Act loosened certain aspects of UK GDPR, maintaining adequacy while easing data sharing and automating decision-making rules.