Nigel Farage wants to scrap ‘suffocating’ UK GDPR
Reform UK has pledged to scrap the UK's GDPR data protection regime, arguing it "strangles" small businesses, and replace it with a "light-touch" alternative modelled on New Zealand's system. Leader Nigel Farage and economy spokesman Robert Jenrick unveiled the plan alongside other pro-business promises, framing it as part of a broader effort to cut regulation and taxes for Britain's roughly six million small firms. Critics, including Labour, dismissed the proposals as vague and unworkable, noting Reform UK is itself currently facing a High Court data protection lawsuit.
The UK's Information Commissioner can currently fine businesses millions of pounds for GDPR breaches, whereas New Zealand's equivalent regulator is limited to fines of up to NZ$50,000, though its rules impose broadly similar restrictions on data handling. Reform's wider package includes reversing 2024's National Insurance rise, scrapping income tax on overtime pay, easing inheritance tax on farms, raising the VAT registration threshold from £90,000 to £150,000, and axing the 2035 Zero Emission Vehicle mandate. Shadow chancellor Sir Mel Stride said the plans "collapse on contact with reality" and lacked detail, while Labour accused Farage of trying to distract from scrutiny of a £5 million donation from an overseas crypto-billionaire.
- Reform UK pledges to scrap UK GDPR for a lighter New Zealand-style regime
- Part of wider tax and deregulation pledges aimed at small businesses
- Labour and Tories call the plans vague, costly and unworkable
New here? Start with this
The UK GDPR sets rules for how organisations collect, use and store people’s personal information. It gives people rights over their data and allows the Information Commissioner’s Office, the UK regulator, to investigate breaches and issue large fines.
Reform UK says it wants a lighter set of rules, drawing on New Zealand’s system, as part of a wider plan to reduce regulation for businesses. New Zealand also has rules governing personal data, but its regulator can impose lower fines.
The debate matters to businesses that handle customer or staff data, and to people whose information they hold. Any change would involve balancing the costs of compliance against safeguards and remedies when personal data is mishandled.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Advocates for reform argue that UK GDPR imposes disproportionate compliance burdens on small firms that lack dedicated legal or data-protection teams, forcing them to spend time and money on paperwork better suited to large corporations handling vast datasets. They see a lighter-touch regime, such as New Zealand's, as a way to unlock entrepreneurship and growth by cutting red tape without abandoning the underlying principle that personal data deserves protection. For this camp, proportionality and economic dynamism, not deregulation for its own sake, are the guiding values.
The case against
Critics contend that data protection safeguards are not bureaucratic box-ticking but essential protections against misuse of personal information, and that weakening the Information Commissioner's enforcement powers would leave consumers more exposed to breaches and exploitation. They also question the credibility and specificity of a plan unveiled without detailed legislative proposals, arguing that serious reform of a complex legal framework deserves rigorous scrutiny rather than a soundbite. For them, robust privacy standards and thorough policymaking, not simply lower costs for business, should take precedence.