Today Reform UK, the right-wing party, will announce a set of ‘flagship policies’, including dropping the UK GDPR. Robert Jenrick, the party’s treasury spokesperson, will unveil a plan to replace the UK GDPR with a ‘light-touch style privacy law modelled on New Zealand’. The plans are part of a bid to slash ‘red tape’ for businesses.
Ahead of his announcement, Jenrick said, ‘GDPR has strangled small businesses and tech firms alike in a web of unnecessary regulation.’ He added, ‘Ten years after the Brexit referendum we should not still be following ridiculous EU privacy laws that hurt British businesses.’
This announcement shows a lack of understanding about the nature of UK data protection law; which is common amongst politicians. The UK GDPR is not an ‘EU privacy law’; the clue is in the name. Following Brexit, the conservative government had a chance to make GDPR more ‘British’; they made (in the main) superficial changes including adding ‘UK’ to the title.
We have been here before. Successive governments have proposed and then rowed back on data protection reforms. The most radical of these were in the Data Reform Bill. This was part of the Theresa May Government’s plans to ‘Replace the UK GDPR with a new, more proportionate, UK Framework of Citizen Data Rights.’ There was also the abandoned Data Protection and Digital Information Bill (two versions!).
In the end they all concluded that, ‘It’s not broke, so let’s not fix it’. The most recent amendment to the UK came in the form of the Data (Use and Access) Act 2025 which many have described as ‘tinkering around the edges’.
What Jenrick calls a ‘a web of unnecessary regulation’ includes the right of subject access which was used by Nigel Farage himself to discover the truth about his Coutts bank account being downgraded.
Even if the UK GDPR is replaced it will not fully remove the ‘red tape’ for business especially the tech firms which Reform seems to be courting with these proposals.
The EU GDPR’s ‘extra territorial effect’ will still apply to many big companies as their business will involve ‘the offering of goods or services, to… data subjects in the [EU] or the monitoring of their behaviour as far as their behaviour takes place within the [EU].’(Article 3(2)).
There is no report of Reform making any amendments to the Data Protection Act 2018, part 3 of which governs processing of personal data or law enforcement purposes.
This morning Data protection officers and privacy professionals may be asking ChatGPT about the New Zealand’s Privacy Act. And who can blame them as, despite the ‘Burnham Bounce’, there is still a good chance that Reform UK will form the next government. Here is a useful summary of the New Zealand legislation courtesy of the law firm Linklaters.
Now is the time to remind yourself of the importance of data protection law.
Listen to Episode 10 of the Guardians of Data Podcast. Our guest is Emma Martins who served as Data Protection Commissioner for the Bailiwick of Guernsey for over a decade. Emma is one of the most thoughtful voices in the world of privacy and information governance. In our conversation, she reminds us that data protection law is about far more than compliance checklists, privacy notices or subject access requests. At its core, it is about people, power, democracy and human dignity.
