BrewDog's founder wants his company back. The data watchdog wants to know how he found the shareholders.

The UK Information Commissioner's Office is reviewing complaints that James Watt, the 42-year-old founder who sold the debt-laden Scottish craft brewer BrewDog earlier in 2026, contacted former equity-crowd investors without a clear lawful basis. The Guardian reported the development on 17 July 2026, hours after the BBC carried a separate account from a recipient of one of the emails (BBC, 17 July 2026, 06:00 UTC; Guardian, 17 July 2026, 16:44 UTC).

The complaint arrives at an awkward moment for Watt. He is leading a buyback attempt aimed at reclaiming control of BrewDog, the Ellon-headquartered brand he co-founded in 2007 and that built a global bar network on the back of one of Britain's most crowd-funded equity raises. The ICO's interest has nothing to do with the merits of the bid itself, and everything to do with how he assembled the email list he used to pitch it.

A buyback that needs shareholders it used to have

Watt stepped back from day-to-day operations earlier in 2026, at which point BrewDog's ownership transferred to private-equity backers. The exact structure of that change has not been independently published in detail, but the company's own statements and the BBC's reporting frame it as a sale of the business that left Watt on the outside. He has since been courting the same pool of small investors who backed BrewDog's original "Equity for Punks" crowdfunding rounds, the share-issues that financed the firm's barroll-out through the 2010s.

According to the BBC and the Guardian, those investors received unsolicited emails inviting them to participate in a buyback vehicle. The recipients include people who had previously written publicly about selling their shares at a loss. The Guardian records one such account: "How's this joker got my details?" the recipient is quoted as saying (Guardian, 17 July 2026).

The volume of complaints is the part that has drawn the regulator in. The ICO confirmed to the Guardian that it had received complaints about the campaign and was assessing them. The BBC reports the watchdog is examining how Watt came to hold the contact details of the "equity punks" at all, given that BrewDog's shareholder register should now sit with the new controlling investor and the company's corporate registry rather than with him personally.

The two questions that matter

There are two distinct questions here, and the coverage is at risk of conflating them. The first is commercial: is the buyback real, who is funding it, and on what terms are ex-shareholders being invited back in. The second is regulatory: on what basis did Watt process the data of individuals whose details came to him through his former role at the company.

UK data-protection law draws a sharp line between the personal data a director holds by virtue of running a business and the personal data that person holds once they are no longer running it. A crowdfunded shareholder list is precisely the kind of asset whose continued use by an ex-founder is contested the moment the founder steps down. BrewDog's former "equity punks" bought shares partly as consumers and partly as brand evangelists; they were not buying into a lifelong marketing relationship with the founder as a private individual. The ICO's review will turn on whether the dataset Watt is using was lawfully transferred to him, whether the original consent covered this kind of post-sale approach, and whether the new owners have a competing claim on the same addresses.

Watt has not, in the two outlets' reporting, explained the provenance of the list. The BBC notes his representatives had no immediate comment at the time of publication. That silence is itself the story for now.

A brand whose customers held the keys

The unusual feature of BrewDog's capital structure is also the reason this story has landed. The firm built an empire by selling shares to thousands of small backers, many of them recruited through provocative marketing and a faintly punk aesthetic. Each of those backers became, in marketing language, a stakeholder with reasons to follow the brand that went beyond the price of the beer. When Watt left and then returned seeking capital from the same cohort, he was reaching into a constituency that had been trained to respond.

That, in plain terms, is the competitive advantage he is trying to redeploy. It is also the asset at risk of regulatory challenge. A buyback campaign that only works because the founder retained visibility over the company's former retail-investor base raises a question other corporate transactions rarely have to answer: who, exactly, owns the relationship between a brand and the people who funded it?

The ICO is not adjudicating the buyback. It is, for now, deciding whether the campaign is the kind of direct marketing that requires fresh consent under UK GDPR, or whether it falls within an exception. The two-week gap between Watt's departure from the business and the emails to shareholders will be one of the easier facts for investigators to verify.

What to watch

The ICO has not opened a formal investigation; it is at the assessment stage. A decision to escalate, either into a formal probe or into enforceable undertakings, would land within weeks rather than months. BrewDog's new owners will also have a working interest in the answer, since a ruling that the ex-founder retains no legitimate claim on the old register would set a precedent for any departing founder of any UK company whose cap table was built through crowdfunding.

The buyback itself, separate from the data question, will succeed or fail on commercial terms that have not yet been disclosed. The price offered to the equity punks, the structure of the vehicle, and the participation rate among the long-tail shareholders who sold at a discount in recent years are the variables to watch. None of that resolves the data complaint, and the data complaint will not stay neatly inside the corporate story. It will sit, for as long as the ICO takes to decide, as a public reminder of how much ownership over a customer list a founder is entitled to take out the door when they leave.

This piece was written by Monexus in the UK and Ireland desk's staff register. The wire had it as a personal-data story; we read it as a corporate-governance one too.