GDPR for iGaming Operators: Player Data, KYC and Retention Done Right

Online gambling operators process some of the most sensitive personal data in consumer business: identity documents, financial details, behavioural profiles and, in responsible-gambling contexts, indicators of vulnerability. GDPR applies in full, and gambling regulators increasingly coordinate with data-protection authorities. This guide covers the areas where operators most often get it wrong.

Lawful bases for processing

Identity verification, AML screening and transaction monitoring are processing activities required by law, and the appropriate lawful basis is legal obligation, not consent. Marketing requires consent or, in limited cases, legitimate interest with an opt-out. Responsible-gambling monitoring is generally grounded in legal obligation or legitimate interest depending on the jurisdiction. Getting the basis wrong undermines the entire processing chain and is a common finding in audits.

Special-category and sensitive data

Responsible-gambling interventions can involve inferences about health, addiction or financial distress. Where such data is processed, operators need an Article 9 condition, typically substantial public interest under national law, and strict access controls. Biometric data used in facial-recognition KYC is special-category data and requires explicit consent or another valid condition, with a DPIA.

Retention versus record-keeping

Gambling and AML laws require records to be kept for years, often five or more after the end of the relationship. GDPR requires data to be kept no longer than necessary. The reconciliation is a retention schedule that ties each data category to its legal basis and retention period, deletes or anonymises data when the period ends, and documents the rationale. Indefinite retention of everything is not compliant.

Suppliers and international transfers

Operators share player data with platform providers, KYC vendors, payment processors, game studios and affiliates, many of them outside the EEA. Each needs a data-processing agreement or, where the supplier is a controller, a transfer mechanism such as standard contractual clauses with a transfer impact assessment. Suppliers in gambling hubs outside the EEA, including the Isle of Man and the UK, benefit from adequacy decisions, but others do not.

DPIAs and the DPO

Profiling players for responsible gambling, fraud or marketing at scale requires a data-protection impact assessment. Most gambling operators must appoint a data protection officer because of the scale and nature of monitoring, and several gambling regulators require a named data-protection key person in any case.

Data-subject rights and self-exclusion

Access requests are frequent in gambling disputes, and operators must respond within a month. Deletion requests conflict with regulatory retention and self-exclusion obligations, and operators must explain the legal basis for refusing them.

Our compliance team helps operators align GDPR with gambling and AML obligations through retention schedules, DPIAs and supplier agreements.