If you've ever crowdfunded a company, you might assume that when the business is sold, your personal data stays with the new owner – or is deleted. But BrewDog's recent saga shows it's not that simple. In July 2026, co-founder James Watt emailed thousands of former shareholders, asking them to back his bid to buy back the brewery. Many recipients were baffled: how had he got their contact details? The complaints that followed have put a spotlight on what happens to investor data when a company collapses or is taken over.
James Watt co-founded BrewDog in 2007. Over the years, the company raised millions through crowdfunding, calling its investors "equity punks". In March 2026, after the company collapsed with debts of more than £500m, US drinks firm Tilray bought BrewDog's brand, intellectual property, UK breweries and 11 bars for about £33m. The deal rendered the shares of roughly 200,000 crowdfunding investors worthless. Then in July, Watt announced a plan to buy back BrewDog through his new venture, Second Best. He claimed 43,000 equity punks had joined him – and to invite them, he emailed thousands of former shareholders.
“BrewDog founder James Watt faces GDPR complaints; explains crowdfunding investor data rights.”
The problem is that former shareholders didn't know how Watt got their details. Under the UK's General Data Protection Regulation (GDPR), organisations can only use personal data for specific, lawful purposes, and must tell people how they obtained it. The Information Commissioner's Office (ICO), the UK's data privacy watchdog, said it was "assessing" information after receiving complaints. Tilray stressed it did not provide Watt with shareholder data; it said it only acquired a customer CRM database of people who opted in to BrewDog communications. Watt claimed he used "lawfully obtained data" following legal advice, but did not explain how.
For UK readers, this case is a reminder that data rights don't disappear when a company changes hands. The ICO has the power to fine organisations or order them to change practices if it finds a breach. But the rules can be unclear: what happens to crowdfunding investor data when a company goes into administration? Who owns that data – the old company, the administrators, or the new owner? The BrewDog case could set an important precedent.
Q: What is GDPR and why does it matter for crowdfunding investors? GDPR is a set of strict rules that govern how organisations collect, store and use personal data. It gives individuals rights over their data, including the right to know how it was obtained and to object to its use. For crowdfunding investors, this means a company cannot share or use your contact details without a lawful basis – even if the founder wants to reach out.
Q: Can James Watt legally contact former BrewDog investors? It depends on how he got their details. If he used a database that was lawfully transferred to him as part of a business deal, and investors had consented to being contacted, it might be allowed. But if the data was obtained without consent or from an improperly shared list, it could be a breach. The ICO is now investigating.
Q: What should I do if I receive an unsolicited email from a company I once invested in? You can ask the sender how they got your data. If you're unsatisfied, you can complain to the ICO. The ICO can investigate and, if it finds a breach, can issue fines or require the organisation to stop using the data. You also have the right to request your data be deleted under GDPR.
What happens next is uncertain. The ICO is assessing the complaints against Watt. Tilray has said the BrewDog brand is not for sale and plans to reject Watt's takeover effort. If the ICO finds a breach, it could set a warning for other crowdfunded companies and their founders. For now, the key lesson for UK investors is to be aware of your data rights – even after a company you backed has been sold.