Gambling Subject Access Request: How to Access Your Betting Data

Every player has a right, under Article 15 of UK GDPR, to access the personal data held about them by a betting operator.

Deadline and Identity Verification

To start the countdown, the subject access request (SAR) should include a valid name, address, and other identifying details.

The Gambling Commission states that a SAR “should include the requester’s name, address, details of what is being asked for, and how the information should be received.” This request starts the clock.

The operator may ask for proof of identity before proceeding with the SAR, as gambling regulators routinely do [Ref]5,6,9,10[/Ref]. The Gambling Commission’s practice is to request ID details after the request is submitted. [Ref]6[/Ref].

What a Gambling SAR Can Ask For

A SAR is not a broadly-worded information grab. Under GDPR, it is a targeted request for personal data relating to the gamer’s use of the operator’s site, and the AR may ask for the specific categories of that data.

The SAR should pursue information used by the operator to make account decisions, which could include:

• Transaction history, showing deposits, withdrawals and losses
• “Know your customer” checks completed on account creation
• Marketing segment,, or
• Account health metrics, such as risk flags or negative reviews
• Any call recordings or notes taken by account managers

This SAR wording is based on the consumer SAR template published by gambling industry analyst Caan Berry, which cites Article 15 GDPR as the statutory basis. [Ref]12[/Ref].

How to Send the SAR

The SAR can be made verbally, in writing, or through an operator-supplied form. It should include the gamer’s name, usage name and registration email, and describe the data requested.

The Gambling Commission handles SAR requests through an email form at and states that it provides responses within a month, or a month after any requested ID materials are received. [Ref]3,10[/Ref].

Some of the SARs may require more than usual time to receive a response. For instance, Sky Bet says that complex or multiple requests may take longer than the usual one-month response time. [Ref]7[/Ref].

What Can Slow or Limit Disclosure

A SAR is not a fishing expedition, and the regulations provide mechanisms to curb unsupported or excessive requests for operator material.

The SAR handler may ask for time to verify the the gamer’s identifying details before starting the SAR process, and may provide only data for the account tied to that verified identity.

The UK law provides an exception from disclosing a few identities, including third-party data or data covered by legal privilege (for instance, controller solicitor-client communications). The ICO has also found that material prepared for a regulator’s review or. A

charge may be levied for a “contentious” request, or for further copies of the same data. But in practice, gambling operators like Sky Bet say they will provide most SAR data for free. [Ref]7,10,11[/Ref]

What The SAR is For

The SAR is a targeted request for a gamer’s personal usage data from an UK-regulated gambling operator, typically pursuant to Article 15 GDPR. It obtains information about the gamer’s account, financial status, and any risk levels set by the SAR handler.

[Ref]2,12[/Ref].

Gamers commonly use SARs to appeal for account closure or loss decision, to contest affordability measures, or to reconstruct betting histories. But the primary right is Article 15 GDPR’s statute: that a person has the right to obtain a copy of their personal data used by the controller, in enough detail to verify “whether the SAR handler has used those personal data in compliance with the regulations.”

[Ref]1[/Ref].

A requester should send their SAR to the right address, with valid ID, and should make a focused request for their personal data that can be verified, obtained, and met within the UK framework and