Casino GDPR data rights UK players guide 2026: your rights under UK GDPR. Licensed by the UK Gambling Commission (licence independently confirmed), [Casino] processes personal data including name, date of birth, address, email, phone, payment details, transaction history, gambling behaviour, and KYC documents. Your right to access allows you to request all data held within 30 days free of charge. You may also request erasure of personal data, though gambling records can be retained for 5–7 years for AML compliance. Portability lets you receive your data in a machine-readable format. Object to marketing uses of your information.
Withdrawal processing typically takes 24–48 hours for e-wallets, according to published terms. Minimum deposits start at €20 for welcome offers, subject to current wagering requirements.
Right to access lets you obtain all personal information a casino holds about you, including gambling activity logs and KYC records. Right to erasure requires casinos to delete your data unless legal obligations like AML checks prevent it. Right to rectification allows correction of inaccurate personal details. Right to portability enables receiving your data in a structured format for transfer between providers. Right to object lets you opt out of promotional communications.
Email the casino’s Data Protection Officer using the contact listed in their Privacy Policy. Responses arrive.
Casino Gdpr Data UK Players Must Know Their Access Rights
UK players can legally request all personal data a casino holds about them under UK GDPR. This includes name, date of birth, address, email, phone number, payment details, transaction history, gambling behaviour, and KYC documents like ID or utility bills. The right to access applies to every registered account holder, regardless of whether they are actively playing or have self-excluded. Casinos must respond to Subject Access Requests within 30 days, providing a complete copy of stored information at no cost.
The most common request involves reviewing one's own gambling history. Under UK GDPR, players have the right to receive this data in a machine-readable format. Casinos must disclose transaction patterns, deposit and loss amounts, session durations, and any self-exclusion flags. This data helps identify problematic behaviour, but also reveals how operators track user activity across platforms.
Casinos may refuse full erasure of gambling records if they are required for anti-money laundering (AML) compliance. UKGC rules mandate that transaction histories be retained for 5–7 years to detect suspicious activity. Therefore, while you can request deletion of non-essential data like marketing preferences, core gambling records may remain accessible for regulatory purposes.
If a casino fails to respond or denies a legitimate request without valid justification, players can escalate to the Information Commissioner’s Office (ICO). The ICO can issue enforcement notices and fines of up to €20 million or 4% of global turnover. However, resolution typically takes 3–6 months, and success depends on clear documentation of the original request.
Casinos are obligated to inform players how to exercise these rights in their privacy policy. Look for explicit sections titled “Your Data Rights” or “GDPR Compliance.” If unavailable, contact customer support directly and request the Data Protection Officer’s email address.
Your Right to Erasure: Important Limitations
The right to erasure (or “right to be forgotten”) allows The site to request deletion of all personal data held by a casino. However, this right is not absolute. UK GDPR Article 17 permits casinos to retain data if its deletion would hinder compliance with legal obligations.
For gambling operators, this primarily relates to anti-money laundering (AML) regulations enforced by the UKGC. Transaction histories, deposit sources, and identity verification records must often be preserved for 5–7 years to prevent financial crime. Thus, while you can erase your email or phone number, your gambling activity may remain in internal logs.
Additionally, casinos may retain anonymised or aggregated data for statistical analysis. This means your individual behaviour could contribute to broader risk assessments without violating your rights. Always clarify whether your specific records are being deleted or archived under legal necessity.
If your request is denied, the casino must provide a written explanation citing the specific legal basis. You then have the right to complain to the ICO, which may compel compliance if the refusal was unjustified.
To exercise your data rights, send a formal request to the casino’s Data Protection Officer (DPO). This information must appear in the casino.
The operator: The casino Must Know Their Access Rights (Operational view). The operator at licensed casinos can exercise five core GDPR rights: access their personal data via Subject Access Request, request deletion of non-essential records, correct inaccuracies, obtain portable copies, and opt out of marketing communications, though gambling records may be retained for AML compliance.
Casinos typically retain personal data including full name, date of birth, address, email, phone number, payment details, transaction history, and behavioural patterns such as deposit frequency and game preferences to meet regulatory and security obligations.
Your right to erasure allows full data deletion requests, but casinos may legally refuse removal of gambling records for up to seven years under anti-money laundering regulations that mandate retention of financial activity logs.
To submit a valid Subject Access Request, email the casino’s designated Data Protection Officer using contact details published in their Privacy Policy, ensuring the query specifies "The site" for prompt processing under UK law.
Casino response timelines require completion within 30 days of request receipt, extendable to 90 days for complex cases involving large data volumes or multiple verification steps, with mandatory notification if delays occur.
The UK Gambling Commission enforces strict data handling standards, requiring all licensed operators to implement encryption, access controls, and breach notification protocols within 72 hours of discovering security incidents affecting player information.