Watt's in your inbox? BrewDog founder's buyback outreach puts UK data watchdog on the clock

At 06:00 UTC on 17 July 2026, the Guardian published an exchange that could hardly have been calibrated to embarrass its subject more precisely. A former BrewDog crowdfunder, contacted out of the blue by founder James Watt with an invitation to help him buy the business back, replied with the question now sitting in front of the UK's data regulator: "How's this joker got my details?"

Within hours, the BBC reported that the Information Commissioner's Office had begun receiving complaints about how Watt obtained the contact information of the thousands of people who, between 2010 and the brewer's later private rounds, put money into the company under the self-styled "Equity Punk" banner. The episode cuts to a question UK plc keeps postponing: when a founder sells a business and later wants it back, who actually owns the customer, supporter and shareholder lists built along the way?

A founder who will not quite leave the room

Watt is no longer running BrewDog. He and co-founder Martin Dickie stepped back from day-to-day leadership and sold control of the heavily indebted craft brewer earlier in 2026, a deal the Guardian framed against the company's well-documented balance-sheet stress. He has nonetheless stayed publicly visible as the public face of the brand he built, and is now attempting to organise a management buyout of the company he once owned outright.

To do that he needs capital and, more pressingly, willing sellers. The emails reported by the Guardian and the BBC show Watt writing directly to former crowdfunders with the pitch: help me put a deal together, and share in the upside. The recipients, many of them retail investors who bought in at valuations that have since soured, are not on the company's current shareholder register by accident. They were cultivated, marketed to, and thanked by name in BrewDog's annual reports and at the firm's annual general meetings. Whether the company's new owners knew their data was leaving with Watt's outreach is now the substance of the complaints.

The information question

UK data-protection law is not subtle on this point. Personal information held by a company belongs to the company, and its use after a change of control is constrained by both the UK General Data Protection Regulation and the Privacy and Electronic Communications Regulations. The Guardian's reporting indicates that some Equity Punks had unsubscribed from BrewDog marketing years ago, and were nonetheless contacted directly by Watt.

That detail matters. Under PECR, electronic mail marketing to individual subscribers requires consent, with limited exceptions. The ICO's published guidance on legitimate-interest basis for direct marketing is similarly restrictive, requiring a careful balancing test and a clear ability to opt out. The substantive question for the regulator is not whether Watt may contact people who once invested in BrewDog; it is whether the channel through which he got their addresses, the lawful basis on which they were processed, and the consent status of each recipient survived a change of control intact. The BBC's 17 July report indicates that the ICO is now reviewing complaints on precisely these grounds.

For now, neither the ICO nor Watt has publicly committed to a substantive position. The regulator's standard practice is to assess complaints and decide whether to open a formal investigation; Watt, per the Guardian, has not publicly disclosed the source of his list.

The bigger picture: who owns the relationship

The episode is best read as a stress test for a wider problem in UK corporate governance. Crowdfunding turned a generation of small investors into part-owners of businesses whose later commercial lives bore little resemblance to the pitch deck they had bought. BrewDog's Equity Punk programme, marketed between roughly 2010 and 2018, was among the most visible of those efforts, and BrewDog's annual rituals of crowdfunder AGM access and named thanks built a database that was, in commercial terms, the company's most valuable non-tangible asset.

When that company was sold, the question of what happens to the relationship should have been answered in the sale contract. The reporting suggests it was not. That left Watt, the new owners, and several thousand retail investors in a grey zone where data-protection law, contract law and the etiquette of a founder's personal brand all overlap. The Guardian's wording is pointed: that some recipients had unsubscribed from BrewDog marketing raises a serious question about whether their data was lawfully available for any new use at all.

There is also a corporate-governance point that does not depend on data law. Management buyouts pitched by outgoing founders to the company's own past backers sit awkwardly with fiduciary duty. The directors of any BrewDog vehicle now negotiating with Watt owe their duty to current shareholders, not to a campaign list curated under a different ownership regime. Whether the new owners have been approached separately, on what terms, and at what valuation, are questions the reporting has not yet answered.

Stakes, and what to watch

If the ICO opens a formal investigation, the immediate practical consequence is limited: the regulator can compel disclosure of the data source, audit processing, and impose fines of up to the higher of £17.5 million or 4% of global turnover. Watt personally is unlikely to face a fine of that scale; BrewDog as an entity might. The bigger consequence is reputational. BrewDog has spent a decade marketing itself as the anti-corporate craft-brewer rebel. A finding that the personal data of the people who funded that brand was used without proper basis would not be a regulatory inconvenience. It would be a brand problem of the first order.

Three things are worth watching over the next fortnight. First, whether the ICO confirms in writing that it is treating the complaints as a coordinated referral rather than a series of individual grievances. Second, whether BrewDog's new owners publish any statement distinguishing the company's marketing database from whatever list Watt is using. Third, whether Watt discloses, voluntarily or under regulatory compulsion, how he came by the addresses in the first place. Until one of those three answers lands, the regulatory story will keep doing the work the commercial story cannot.

The complaints are also a quiet rebuke to a sector that built a marketing genre out of treating retail backers as family. Crowdfunders were addressed by first name, invited to AGMs, listed on the wall. They were also, in the strict sense, a database. The current row is what happens when a company remembers the relationship but loses the legal paperwork.

Desk note: Monexus framed this as a data-protection story with corporate-governance weight, rather than as a founder-misfit profile. Wire reporting on Watt has tended to focus on the personality; the more durable question, the one that will outlast the news cycle, is who owns the list.