Most licensed casino operators cleared the initial GDPR hurdle years ago, updated their privacy notices and added cookie banners. The operators who face enforcement action today are typically not the ones who ignored the regulation entirely; they are the ones who treated first-wave compliance as a finished project rather than an ongoing operational discipline. This article is written for teams that already understand the basics and need to stress-test what they have built.
Revisiting Lawful Bases: Where Casino Operators Still Get It Wrong
Many operators lean on legitimate interests as a catch-all lawful basis for marketing, profiling and behavioural analytics. Legitimate interests can be valid, but it requires a documented balancing test that weighs the operator's commercial purpose against each player's reasonable expectations. Supervisory authorities, including the Dutch Autoriteit Persoonsgegevens and the UK ICO, have been explicit: legitimate interests cannot substitute for consent where the processing would surprise or disadvantage the data subject. For behavioural profiling used to personalise bonus offers, consent is almost always the safer and more defensible choice.
A second persistent error is conflating AML obligations with marketing permissions. The legal obligation lawful basis covers KYC, source-of-funds checks and transaction monitoring. It does not extend to using that same data to build a propensity model for upsell campaigns. Those two processing activities require separate lawful bases, and they must be separated at the database level, not just in the privacy notice.
Data Minimisation in Practice: Audit Your Collection Points
Data minimisation is one of the core GDPR principles, yet it is routinely violated at the registration and deposit stages. Operators frequently collect data fields that were added for historical reasons, have no current processing purpose and are never reviewed. A practical approach is to run a quarterly collection-point audit covering:
- Every form field at registration, deposit, withdrawal and verification stages
- Every third-party SDK or tag embedded in the platform, including affiliate tracking pixels
- Every analytic event fired to external tools such as Google Analytics, Mixpanel or Amplitude
- Every customer support system that stores chat transcripts, call recordings or email threads
For each data point, the team should be able to name the lawful basis, the retention period and the deletion mechanism. If any of those three cannot be stated precisely, that data point is a liability.
Cross-Border Data Transfers: The Post-Schrems II Reality
Many online casino platforms rely on US-headquartered cloud providers, CRM vendors and payment processors. Since the invalidation of Privacy Shield in 2020 and the subsequent adequacy decision for the EU-US Data Privacy Framework in 2023, the legal landscape has stabilised somewhat, but it remains fragile. Operators using vendors that self-certify under the DPF should verify that certification is current and covers the specific processing activities in scope. Standard Contractual Clauses remain the fallback for transfers to countries without an adequacy decision, and they must be accompanied by a transfer impact assessment for higher-risk destinations.
From an operational standpoint, operators should maintain a live record of every third-party subprocessor, the country where data is processed and the transfer mechanism in place. This is not a one-time exercise; subprocessors change data centre locations, get acquired or update their terms, and each change can invalidate a previous assessment.
Breach Response: Testing the Plan Before You Need It
Article 33 of the GDPR requires notification to the relevant supervisory authority within 72 hours of becoming aware of a personal data breach that is likely to result in a risk to individuals. For a casino operator running a 24-hour operation across multiple jurisdictions, 72 hours is a very short window. The common failure point is not the absence of a breach response policy but the gap between the policy document and the people who need to act on it.
Operators should conduct tabletop exercises at least twice per year, simulating scenarios such as a ransomware incident affecting the player database, an accidental bulk email exposure or a rogue employee extracting records. Each exercise should produce a written after-action review identifying gaps in detection, escalation and documentation. The exercise findings should feed directly into staff training and technical controls.
Player Rights Requests: Operationalising the Backlog
Subject access requests, erasure requests and portability requests are arriving at higher volumes as player awareness grows and data broker services automate submission. Operators need a verified identity check process that is robust enough to prevent fraudulent requests without creating a barrier that itself becomes a compliance issue. Erasure requests require particular care in gambling: AML record-keeping obligations typically override a player's right to erasure for transaction and verification records, but marketing data, behavioural profiles and bonus history may be fully erasable. These distinctions must be encoded in the data architecture, not handled manually each time.
Sustainable GDPR compliance is an operational function, not a legal project. The operators who avoid enforcement are those who have embedded privacy controls into their product, data and marketing workflows rather than layering documentation on top of unchanged practices.
