EU data protection laws (GDPR) and casinos

Casinos process some of the most sensitive data: payments, KYC documents, gaming history, behavioral analytics, Responsible Gaming (RG) queries. In the EU and EEA, such processing is regulated by GDPR (General Data Protection Regulation). For the operator, these are clear responsibilities and penalty risks; for the player - a strong set of rights and transparency.

Who's Who: Roles and Responsibilities

Controller: most often a B2C casino operator. It determines the goals and means of processing, bears the main responsibility.

Processor: KYC provider, PSP, cloud hosting, anti-fraud, e-mail service - act on behalf of the controller under the processing agreement (DPA).

Joint controllers: possible with common goals (for example, a joint action with a partner) - transparent distribution of roles and informing players are required.

Legal grounds for processing (Art. 6 GDPR)

1. Contract: creating an account, making bets/payments, support.

2. Legal obligation: KYC/AML, accounting, RG requirements, tax rules.

3. Legitimate interests: basic anti-fraud analytics, security, anti-abuse - with mandatory assessment of interests (LIA) and player rights.

4. Consent: e-mail/SMS marketing, optional cookies, some types of personalized advertising and behavioral profiling.

5. Vital interests/public task - rarely applied.

💡 Important: consent should be free, specific, informed and unambiguous, with an easy possibility of withdrawal. Default consent is not allowed.

Special categories and sensitive contexts

Special categories (Art. 9): health, biometrics, etc. - usually not needed. If biometrics for "liveness" are used, it should be handled minimally and on strict ground/procedures.

Juvenile data: strict age control; marketing to children is prohibited.

RG/affordability: Problem game signal processing requires minimization, transparency, and DPIA.

Player (data subject) rights

Access (Art. 15): copy of data and description of processing.

Correction (Art. 16) and removal (Art. 17) where possible and does not conflict with AML/accounting retention periods.

Restriction (Art. 18) and objection (Art. 21) - for example, against marketing on "legitimate interest."

Tolerability (Art. 20): profile data in machine-readable form.

Do not be the object of a solution based only on automated processing (Art. 22): if there is profiling with legal consequences, explanations and the right to human intervention are required.

The operator is obliged to provide a simple DSAR request channel and respond without unreasonable delays (usually up to 1 month).

Cookies, Tracking & Marketing

Strictly necessary cookies: without consent.

Analytics/Advertising/Personalization: By Consent (Banner/Preferences Dashboard; "on/off" by category).

E-mail/SMS-marketing: consent (opt-in) + the ability to unsubscribe in each message.

Retargeting and look-alike audiences: require explicit notification and usually consent.

Self-exclusion/RG: no promo for disabled and self-excluded accounts.

Retention

Store "no longer than necessary" for:

KYC/AML: years (by law, by jurisdiction).
Game logs and transactions: according to license rules and audits.
Marketing profiles: before withdrawal of consent or expiration of activity; on recall - stop processing and delete/anonymize.

We need retention policies, automatic deletion/anonymization tasks, and a registry of operations (RoPA).

International data transfers

If the data is outside the EEA:

SCC (standard contractual provisions) are used and Transfer Impact Assessment (TIA) is carried out; the laws of the recipient's country and technical measures (encryption, pseudonymization) are checked.
Alternatives: recipient country adequacy, Binding Corporate Rules, etc.
The operator is obliged to transparently inform the player who receives the data and on what basis.

Processing security (Art. 32)

TLS/HTTPS everywhere, encryption "on disk" (at rest), payment tokenization, access segregation, logs (audit trail), DLP.

Incident management: monitoring, response plans, regular tests.

Impact Assessment (DPIA): for high risk scenarios (e.g. large behavioral analytics, new biometric checks).

Data Protection Officer (DPO): mandatory if scale/type of processing requires it (often yes for licensed operator).

Violations and notifications (breach)

In the event of a leak or security incident, the operator:

1. assesses the risk to rights and freedoms, 2. notifies the supervisory authority within 72 hours, 3. at high risk - informs players in understandable language, 4. documents everything and implements remediation measures.

Case studies

KYC и AML:

Grounds: legal duty + general AML/CFT task.
Minimization: Do not store CVV; documents - only in secure storage, access by role.
Terms: by law; after their expiration - deletion/anonymization.

Anti-fraud и RG:

Basis: legitimate interest and/or legal duty; LIA + DPIA with extended profiling.
Transparency: describe the types of signals (velocity, device, output cancellation), intervention logic and player rights.

Marketing:

By consent only; detailed preference center; instant unsubscribe; exclusion of self-excluded/restricted VIPs.

Common operator errors

They mix legal grounds (for example, marketing under the guise of a "legitimate interest" without an LIA).

Keep data "forever," no retention policy.

"Deaf" cookie banner without real refusal.

No RoPA, DPIA, DPO or they are "for show."

Transfers outside the EEA without TIA and technical measures.

Players do not find where to send DSAR, responses are delayed.

What is important to know the player (rights in practice)

You can request a copy of your data and processing history.

You can object to marketing and withdraw consent - promos must be stopped.

You can correct inaccuracies, require deletion (if there is no legal obligation to keep).

In a high-risk leak, you should be notified in an understandable way.

Look on the site: privacy policy, DPO contacts, cookie center.

Operator's checklist (short)

Legal and Documentation

RoPA, LIA, DPIA, DPA with processors.
DPO assigned; DSAR channels are operational and documented (SLA).
Transparent privacy policy, separate RG/AML justification page.

Process and Safety

TLS 1. 2/1. 3, encryption at rest, PAN tokenization, role access, logs.
Retention policies and automatic deletion/anonymization.
Incident plans, tests, 72-hour notification.

Cookies/Marketing

This CMP: opt-in/opt-out by category, opt-out logic is executed.
Opt-in to e-mail/SMS, instant unsubscribe; excluding the self-excluded.

International transmissions

SCC + TIA, technical measures; register of third countries and processors.

Player checklist

Read the privacy policy; I understand what data, why and how much they store.
Set up cookie preferences, unsubscribed from unnecessary marketing.
I know how to submit a DSAR and contact the DPO.
Enabled 2FA/Passkeys and login/change notifications (account protection is also data protection).
Use only https ://on the official domain; I upload KYC documents through the built-in portal.

FAQ (short)

Can an operator refuse to delete data?

Yes, if there is a legal duty to keep (e.g. AML/accounting). After expiration - deletion/anonymization is mandatory.

Do I need a separate consent for basic anti-fraud analytics?

Usually not (legitimate security interest/duty), but requires LIA, transparency and the ability to object if it does not undermine security.

Email marketing without consent - is it possible?

In the EU, as a rule, opt-in is needed (there are nuances of "soft" opt-in for customers - act according to local law and proportionate practice).

Where to complain if rights are violated?

In support of/to the DPO, then to the national data protection watchdog (DPA).

GDPR in gambling is not a paper formality. This is about minimization, transparency, security, shelf life and player rights. An operator who competently formalized legal grounds has built processes (DPIA, DPO, DSAR, TIA) and technically protects data, receives a stable license and trust of payment partners. Player - controls his data and gets a predictable, secure experience.