Reform UK GDPR replacement plan targets New Zealand-style privacy laws

Replacing the current data protection framework would fundamentally alter how streaming platforms and tech firms manage user data within the UK market. By moving toward a New Zealand-style model, the proposal seeks to lower compliance costs that Reform UK claims currently hinder small-scale innovation and technical scaling. This shift would create a significant regulatory divergence from the European Union, potentially complicating cross-border data flows for international streaming entities. Industry observers should monitor whether these proposals gain traction in upcoming policy debates, specifically regarding the feasibility of maintaining data adequacy status with the EU while adopting more lenient domestic standards.

Reform UK's proposal to replace the UK GDPR with a New Zealand-style privacy framework arrives amid a broader Conservative and Labour debate over post-Brexit data regulation. The current Labour government has pursued its own data reform agenda through the Data (Use and Access) Act, which received Royal Assent in June 2025. The Act introduced changes to automated decision-making rules and scientific research provisions while retaining the core GDPR structure, meaning any future Reform UK government would need to dismantle a recently enacted legislative framework rather than simply repealing EU-derived rules. This distinction matters because the Data (Use and Access) Act was specifically designed to maintain EU adequacy while reducing certain compliance burdens, creating a political and legal baseline that Reform UK's more radical proposal would need to overcome.

The EU adequacy question is central to the commercial viability of Reform UK's plan. The European Commission granted the UK adequacy decisions in June 2021, and those decisions are subject to periodic review with the next assessment expected before their June 2025 expiry was extended. If the UK diverges significantly from GDPR standards, the Commission could revoke adequacy, forcing companies to rely on Standard Contractual Clauses or other transfer mechanisms for cross-border data flows. New Zealand itself maintains EU adequacy, but its Privacy Act 2020 operates within a fundamentally different constitutional and trade context than post-Brexit Britain. Legal scholars at the University of Oxford have noted that the UK's data protection framework is more deeply integrated with EU digital trade agreements than New Zealand's, making a direct transplant of the Kiwi model legally complex.

For streaming platforms and ad-tech companies operating in the UK, the practical implications hinge on enforcement mechanisms and consent requirements. New Zealand's Privacy Act 2020 does not require explicit opt-in consent for most data processing, relying instead on a principles-based approach overseen by the Office of the Privacy Commissioner. The New Zealand model has been cited by UK business groups including the CBI as a template for reducing compliance costs, though critics argue it offers weaker individual rights protections. The Information Commissioner's Office currently enforces UK GDPR with powers including fines of up to 4% of global turnover, a deterrent that would likely be diluted under a lighter regime. For streaming services that rely on personalized advertising and cross-border data transfers between UK and EU operations, any shift away from GDPR alignment would require reassessment of data processing agreements and potentially new transfer impact assessments.