Personal data and account evidence

How to request your personal data from a casino

A subject access request asks a controller for your personal data and supporting information about its use. It is not a gambling complaint, a demand for every internal business document or a route that guarantees compensation, disclosure or complaint success. A useful request identifies the account, limits the period and names the data needed for a clear purpose.

Check whether UK data rights apply before relying on them

The ICO guidance used here explains rights under the UK GDPR and Data Protection Act 2018. Whether those rights apply depends on the controller, the processing and the connection to the UK. A casino being accessible from Britain, using English or holding an overseas gambling licence does not by itself settle that question.

Start with the current privacy notice and terms. Record the legal entity said to control the data, its contact details, any representative or data-protection contact, the account domain and the jurisdiction claimed. If UK applicability is uncertain, state that uncertainty instead of presenting an ICO route as guaranteed. The offshore complaint route map explains why a gambling regulator, data authority, payment provider and court have different powers.

A subject access request and a gambling complaint do different jobs

The same facts may create more than one route, but keep the questions separate. Use the casino complaints guide for the service dispute and the complaint evidence pack to preserve a dated chronology. Do not wait for a subject access response if a separate complaint or legal deadline may expire.

Verify the controller and secure destination

1. Open the current privacy notice independently. Do not rely on an address supplied only in an unsolicited message or social-media reply.
2. Record the legal entity. Keep the controller name separate from the casino brand, platform provider, payment firm and gambling licensee.
3. Confirm the channel. Prefer the rights form, account portal or privacy email published on the verified domain.
4. Save evidence of delivery. Keep the submitted text, destination, date, time, time zone and acknowledgement.
5. Do not expose the request publicly. Account identifiers and personal records should not be posted in a review, forum or public complaint.

Choose data categories that match the task

A request does not need legal wording or the phrase subject access request to be valid, but precision can make it easier to identify the records. Ask for your personal data rather than naming every document the business may hold. The ICO says a controller may perform a reasonable and proportionate search. Some material may also be restricted, exempt or redacted, including information about another person.

Copyable focused request builder

Identity checks must be necessary, proportionate and secure

A controller may ask for information reasonably needed to confirm identity, particularly where it has genuine doubts. The ICO says the check should be reasonable and proportionate and that formal identification should not be demanded unless it is necessary. The controller should request needed evidence promptly, and the response period begins once it receives the required identity information.

Ask why each item is needed, whether an existing authenticated account or lower-risk identifier is sufficient, how it will be transferred and how long it will be kept. Redact irrelevant fields where the controller confirms that is acceptable. Use only the verified secure route. Never send identity documents through social media, an unverified email or a link received only from an unsolicited contact. The source-of-funds and source-of-wealth guide explains why a financial-evidence request is a separate process with its own privacy test.

Track the one-month period without promising an exact outcome date

The ICO states that a controller should respond without undue delay and normally within one month. The period can extend by up to two further months for a complex request or multiple requests, but the controller should explain the extension within the first month. The calculation can depend on when reasonably required identity evidence is received. A reasonably required clarification can pause the clock, but a controller cannot force the requester to narrow a clear request.

Record the request receipt, any identity request, secure identity submission, clarification question, clarification response, extension notice and final response. Use the ICO's current time-limit guidance for the calendar calculation. Do not infer complaint success, compensation or unlawful conduct from delay alone.

A right to personal data is not a promise of every internal document

Section 78 of the Data (Use and Access) Act 2025 clarifies that the right is limited to information the controller can provide after a reasonable and proportionate search. The ICO also describes exemptions and restrictions, third-party information and situations in which a request may be refused or charged for under the applicable rules.

A response may therefore supply personal data extracted from a document without handing over the whole document. It may redact another person's information or explain a lawful restriction. That does not make every restriction correct, but the proper next step is to record the category, explanation and missing information, then challenge it through the appropriate data-protection route. Do not claim entitlement to unrestricted fraud systems, legal advice, source code, another customer's records or every document that mentions an account.

Two fictional request and response scenarios

These cases contain no real casino, account or person. Each requested category is reconciled against one response treatment so an omission is visible without turning a restriction into an accusation. The tests also require multiple account identifiers, a bounded period, secure and limited identity handling and a separate gambling complaint.

Review the response by category, not by document count

1. Confirm the account and period. Check that the response belongs to the correct requester and covers the requested dates.
2. Reconcile every category. Mark it supplied, partly supplied, restricted with a reason, reported not found or unanswered.
3. Keep raw evidence unchanged. Save the response, cover letter, secure-download expiry and file list before annotating a working copy.
4. Protect other people. Do not republish personal data, identity documents or unredacted account records.
5. Ask a precise follow-up. Name the missing category or apparent mismatch and request the controller's explanation without demanding every internal file.

Use the right escalation route

If the concern is how the controller handled the request, first use its data-protection complaint process and keep a written record. The ICO explains how to raise a data-protection complaint and what evidence to include. An ICO complaint is not a casino dispute ruling and does not promise compensation or disclosure of every requested item.

If the unresolved issue is a balance, withdrawal, account closure or gambling decision, continue that issue through the applicable gambling complaint route. Keep the account access, balance evidence, jurisdiction and requested remedy separate without treating the SAR response as the remedy.

Protect identity data and step away if the record shows harm

Store the request and response securely, remove unrestricted sharing links and redact public copies. Do not send a new deposit, verification payment or recovery fee to obtain data. Do not let an unsolicited helper take over the request or ask for an account password, one-time code or payment-card security details.

Copyable request and response evidence record