Reform UK Pledges to Ditch GDPR for New Zealand's Privacy Act

Nigel Farage has doubled down on Reform UK's pledge to tear up the UK GDPR, this time adding a specific replacement model to the conversation: New Zealand's Privacy Act. The Reform UK leader argues that swapping Britain's current data protection framework for a lighter regime modeled on New Zealand's approach would not jeopardize the UK's data adequacy status with the European Union, a claim that goes to the heart of whether this plan is even workable.

What Farage and Reform UK Are Proposing

Reform UK has previously outlined its intention to scrap the UK GDPR as part of a wider push to cut regulatory burdens on business, a plan the party frames as removing red tape that it says has strangled small businesses and tech firms. The latest development gives that pledge a concrete shape: rather than simply deregulating data protection, Reform UK now points to New Zealand's Privacy Act as the template it wants to follow.

New Zealand's law is generally considered less prescriptive than the UK GDPR. It does not impose the same detailed consent requirements, breach notification timelines, or documentation obligations that businesses operating under UK GDPR must currently follow. For a party that has built its data protection platform around cutting compliance costs, that lighter structure is the appeal.

Why the Adequacy Question Matters

The most consequential part of Farage's statement is his claim that scrapping the UK GDPR for a New Zealand-style law would not cost Britain its EU data adequacy status. Adequacy is the mechanism that currently allows personal data to flow freely between the UK and the EU without extra legal safeguards. Losing it would force British companies that handle EU citizens' data to adopt additional contractual measures, adding cost and friction to cross-border business exactly where Reform UK claims it wants to reduce it.

This is where the plan runs into the most scrutiny. The EU grants adequacy status based on its own assessment of whether a country's data protection standards are equivalent to its own, and it can review or revoke that status if it judges the framework has diverged too far. Critics of Reform UK's earlier GDPR pledges have already called the broader proposal unworkable, largely because replacing a GDPR-aligned framework with a materially lighter one is precisely the kind of divergence that could trigger an EU review. Farage's assurance that adequacy would survive the switch is a central claim of this plan, but it is not something Reform UK can guarantee unilaterally since the decision ultimately rests with Brussels.

The Practical Impact on Privacy Rights

Beyond the adequacy debate, the substance of the proposal matters for anyone whose personal data is processed by UK organizations. The UK GDPR currently gives individuals a defined set of rights: to access their data, request corrections, demand erasure, and receive clear breach notifications, obligations that sit alongside the Data Protection Act 2018 as the legal backbone of UK data protection. A New Zealand-style regime, being lighter touch by design, would likely reduce some of these formal protections, even if it aims to keep the country broadly aligned with international norms. The privacy impact of this pledge has already drawn attention from privacy advocates who note that lighter compliance for businesses often translates into fewer enforceable rights for individuals.

What This Means For You

Reform UK is not currently in government, so none of this changes UK GDPR obligations or your data rights today. But the debate is worth tracking if you run a business that handles EU or UK customer data, since any future shift away from UK GDPR could affect compliance requirements and cross-border data transfer rules. For everyday users, the practical takeaway is that your current rights, access requests, breach notifications, and consent protections, remain intact under existing law regardless of political rhetoric.

Key Takeaways

Reform UK's push to replace the UK GDPR with a New Zealand-style law is a policy proposal, not enacted legislation, so it carries no immediate legal weight. Anyone concerned about how this debate might affect their data rights should keep an eye on how the EU responds to any future UK deregulation, since adequacy status is the real fulcrum of this story. In the meantime, continue exercising your existing rights under UK GDPR, including data access and deletion requests, and stay informed as this policy debate develops ahead of any future election cycle.