The Pitbot journal

Data Subject Requests in Online Casino Support: A UK Guide

How casino support teams can spot, verify, route and answer data subject requests within the UK deadline, with human review and an audit trail at every step.

14 min read
Data subject requests

A data subject request is any message in which a player exercises a data protection right: asking for a copy of their data, asking you to delete it, or asking you to correct it. Most arrive through ordinary support channels, not a privacy form. Your frontline team must therefore recognise them, route them and log them within a one-month clock. This guide shows how, with the gambling-specific records, the retention limits and the role AI can safely play.

TL;DR

  • A player does not need formal wording. A plain chat or email asking for their data can count as a subject access request, so support agents are your first line of compliance.
  • The UK deadline is one month from receipt, or from receipt of the identity information you asked for. Extensions are possible only for complex requests, and the player must be told within the first month.
  • Erasure requests are not absolute for licensed operators: some compliance data must stay available for at least five years after the relationship ends.
  • AI can classify, find and draft, but a trained person should approve scope, redactions and the final reply, with every step logged.

Table of Contents

What counts as a data subject request in support

Under UK GDPR, individuals have several rights over their personal data: access, rectification, erasure, restriction, portability and objection. The search term “DSAR” usually refers to the right of access. The ICO describes a subject access request as a person exercising their right to confirm whether you process their data and to get a copy of it. It also says a request can be valid even without formal wording if it clearly asks for that information.

For a casino, this has a practical consequence. A message such as “send me everything you hold on me” typed into live chat at 2am is a request. So is an email to the VIP manager asking what you know about a player’s betting patterns. The EGBA Code of Conduct on Data Protection in Online Gambling makes the same point: operators cannot insist on a particular form, so staff in ordinary customer-service channels must recognise and escalate requests.

The Gambling Commission’s own subject access guidance shows what players are entitled to learn: what information is held, how it is used, who it is shared with and where it came from.

Phrases that should trigger a case

Train agents, and any triage tooling, to flag wording like this:

  • “What data do you have on me?” or “I want a copy of my data.”
  • “Delete my account and everything you know about me.”
  • “Why was my account limited? Show me what your system said.”
  • “Stop using my data for marketing.” (an objection, which also needs suppression)
  • “My date of birth on file is wrong.” (rectification)

A request can also come from a solicitor or a family member acting for the player. Authority to act then needs confirming before anything is disclosed.

Why gambling players send them

Players send access requests for many reasons, and the reason does not change your obligation. A Legal 500 review of the gaming sector notes that requests often follow formal complaints, bonus disputes, account closures or responsible-gambling decisions, including self-exclusion failures and affordability concerns.

The data at stake is wide. It can include transaction histories, session data, betting patterns, communications, responsible-gambling tool outputs and affordability assessments. Public attention on this has grown: Computer Weekly reported on a High Court case in which Sky Betting was said to assign each tracked individual around 500 behavioural data points. Players are increasingly aware that operators profile them, and some will ask for exactly that profile.

Treat a request as a normal, predictable part of operations rather than an exception. If your team expects them, they stop being emergencies.

Why gambling players send them

The one-month clock

The ICO sets the rule in its guidance on responding to a request. You must comply without undue delay and at the latest within one month of receipt. The month can instead run from receipt of information you asked for to confirm identity, to confirm a third party’s authority, or a fee where one is allowed. The ICO also says to count from the actual date of receipt, even if that is a weekend or bank holiday, and that the deadline moves to the next working day if the final date falls on a non-working day.

The Gambling Commission applies the same logic to its own handling: its one-month period does not start until requested ID arrives.

Extensions

For complex or numerous requests the period can be extended by up to two further months. You must tell the player within the first month and explain why. Do not treat the extension as a default. A player with ten years of play, multiple chat transcripts and several linked accounts may justify one. A player asking for a single email thread does not.

Operators serving several markets

If you license in more than one country, the clocks differ. Under GDPR it is one month. California’s CCPA allows 45 days with a possible 45-day extension, and Brazil’s LGPD sets 15 days for confirmation and 30 for a full response, as summarised in a multi-jurisdiction compliance guide. Record the player’s jurisdiction at intake so the right clock starts automatically. For UK-licensed play, use the UK rules in this article.

What a gambling operator may need to disclose

Article 15 of the regulation, as it appears in UK legislation, requires more than a data export. The response includes:

  • a copy of the personal data;
  • the purposes of processing and the categories of data;
  • recipients or categories of recipient;
  • the retention period, or the criteria used to set it;
  • the person’s rights, including the right to complain to the regulator;
  • the source of data not collected from the player;
  • the existence of solely automated decision-making or profiling, with meaningful information about the logic, where it applies;
  • safeguards, where data goes to a third country.

An electronic request should normally receive the answer in a commonly used electronic format, and further copies may attract a reasonable administrative fee.

Where the data actually sits

In a casino, the player’s data is spread across systems. A useful checklist, drawn from the EGBA code and from how a regulated operator describes its own DSAR process:

Record typeExamplesTypical owner
Account and paymentsDeposits, withdrawals, chargebacks, account statementPayments, finance
GameplayCasino and poker history, win and loss, large-win recordsProduct, data team
CommunicationsEmails, chats, SMS, Telegram, call notesSupport
Bonuses and marketingOffers received, consent, suppression flagsCRM, marketing
VerificationKYC, age checks, source of fundsCompliance
Safer gamblingLimits, self-exclusion, affordability and interaction recordsSafer gambling team
Automated decisionsRisk scores, flags, model outputsRisk, compliance

Support sits in the middle. It owns the communications record and is usually where the request lands, but it does not own most of the rest. That is why a case with an owner per system and a visible due date matters more than any single tool.

Redaction and exemptions

Players get their own data, not other people’s. The EGBA code says operators should review chat logs so the player’s data is provided while other individuals’ data is extracted or redacted. Material covered by legal privilege, or protected by a legal requirement, may need withholding, subject to national exemptions. Agent names, other players in a chat room and internal notes naming colleagues are the usual redaction candidates. Whether an exemption applies is a decision for your data protection officer or legal counsel, not for a first-line agent.

Right to be forgotten: what you can and cannot delete

An erasure request is the other half of what players ask for. Erasure rights are restricted where keeping the data remains necessary for a permitted purpose, including a legal obligation. The Gambling Commission’s guidance on gambling regulation and GDPR says licensees should consider crime-prevention objectives, including preventing money laundering, and should keep relevant regulatory-compliance data available for at least five years after the customer relationship ends.

So a reply to “delete everything” is rarely a simple yes or no. A sound reply:

  1. Confirms what you have received and when.
  2. Explains which data you will delete, such as marketing profiles and non-essential communications where no obligation applies.
  3. Explains plainly which data you must keep, why, and for roughly how long.
  4. States the player’s right to complain to the ICO.

Where a player has self-excluded or been flagged for safer gambling concerns, make sure that deletion of marketing data does not remove the suppression record that stops promotions. Keep the suppression flag, and tell the player it exists.

A support workflow that holds up

The pattern below works for a team handling requests across email, live chat, SMS and Telegram.

  1. Recognise. Tag any message that asks for data, deletion, correction or an explanation of a decision. When in doubt, open a case. A false alarm costs minutes; a missed request costs weeks of the clock.
  2. Log at intake. Record the date received, channel, jurisdiction, right requested and player ID. The EGBA code recommends a documented procedure, trained customer-service staff and a request log to manage deadlines and accountability.
  3. Verify identity in proportion. Ask for only what you need to be confident the requester is the account holder. If you ask, the month restarts from when the information arrives, so ask promptly and once.
  4. Acknowledge. Tell the player you have the request and when to expect an answer. Do not promise a copy before you know what you hold.
  5. Collect. Assign each system to its owner with a due date well inside the month.
  6. Review and redact. A named reviewer checks scope, third-party data and exemptions.
  7. Deliver securely. Use a commonly used electronic format and a secure channel, not an attachment to an open chat.
  8. Close and record. Keep the case file, what was disclosed, what was withheld and why.

Two cautions matter most. First, never let an agent paste disclosed data into a chat window without the reviewer’s approval. Second, keep identity checks out of the open chat history, so that the verification material does not become more personal data scattered across transcripts.

Using AI without losing control

AI can do useful work here: classifying incoming messages, extracting the player ID, calculating deadlines, summarising long transcripts and proposing redactions. It should not release the result unaided.

There is a regulatory reason as well as a practical one. Under the Gambling Commission’s customer interaction guidance, where decisions use automated processes, the licensee must manually review operation in each individual customer’s case. It must also give the customer an opportunity to contest a solely automated decision that has a legal or similarly significant effect. A DSAR reply that tells a player what you hold, and why a limit was applied, falls squarely within that spirit.

The working rules we suggest:

  • AI drafts, a person approves. Every outgoing reply is reviewed before it reaches the player.
  • Personal data is minimised before it reaches any model. Our note on redacting PII before it goes to a model explains the approach.
  • Each stage leaves a timestamped record: who saw what, what changed, who approved.
  • Sensitive cases escalate to people automatically. Complaints, signs of vulnerability and legal threats should never sit in an automated queue. Our six-stage reply review workflow shows how review stages catch compliance risk.

Disputes are a common trigger for requests, so it helps to connect the two processes. Our piece on handling player disputes around the eight-week ADR window covers how to keep the complaint file and the DSAR file consistent.

Safer gambling and marketing: the overlap

A DSAR from a player with a safer gambling history is delicate. The response may include affordability assessments, interaction records and risk flags. Make sure the person who reviews it understands the context, and that the reply does not itself become a marketing touchpoint. If a player objects to marketing in the same message, suppress outreach at once and confirm it. For detection and outreach suppression, see our page on responsible gambling automation. For monitoring that sits behind these decisions, our UK guide to high-risk player monitoring goes further.

Our perspective

We built Pitbot around one belief: in a regulated market, speed and oversight are not a trade-off. A player who asks for their data in a live chat deserves a fast acknowledgement, and the operator deserves proof that a person checked what was said.

That is why every AI-generated reply in Pitbot is reviewed by staff before it reaches the player. For data subject requests this matters twice. The agent needs help recognising a request that arrives in casual wording, and the compliance officer needs a trail showing who approved each reply and when.

We also think the unglamorous parts decide whether a team copes: a single workspace across email, chat, SMS and Telegram, automatic escalation of sensitive cases, multilingual handling for international players, and marketing suppression that cannot be bypassed. Our aim is for no request to be missed, and no reply to go out unreviewed.

pitbot

Where Pitbot fits

Pitbot is our AI player support platform for online casino operators. It combines several AI providers with human review of every reply, supports email, live chat, SMS and Telegram, detects sentiment and escalates sensitive cases, manages VIP queues, and keeps an audit trail of each decision, all from one dashboard. For a team handling data subject requests, that means requests arriving in any channel can be seen, reviewed and recorded in the same place. See how it works on our online casino customer support page, or review the full feature list.

Pitbot

If you want to see the review and audit workflow in your own channels, book a conversation with the Pitbot team. For wider context on oversight, read our compliance playbook for human-reviewed AI.

Preparing your team

A short internal checklist is often enough to prevent missed requests:

  • A one-page procedure naming who owns intake, who verifies identity and who signs off the reply.
  • Example phrases for agents, including the casual ones above.
  • Template replies for acknowledgement, identity checks, extensions and partial erasure, approved by your data protection lead.
  • A monthly review of the request log: volume, time to close, anything late.
  • A named escalation route for requests that touch complaints, safer gambling or legal threats.

Run a drill once. Send a test “what do you hold on me?” through each channel and see how long it takes to reach a case with a due date. The result will show you where the process leaks.

FAQ

Is a data subject request the same as a DSAR?

A DSAR, or subject access request, is one type of data subject request: the right to see your own data. Data subject requests also cover erasure, correction, restriction, portability and objection. In support, it is safest to treat any message invoking one of these rights as a request.

How long do we have to respond in the UK?

One month from receipt, or from receipt of identity information you asked for. Complex or numerous requests can be extended by up to two further months, provided you tell the player within the first month and give reasons. The ICO guidance explains how to count the month.

Can we refuse to delete a player’s data?

Partly, yes. Where you need data to meet a legal obligation, such as anti-money-laundering or licensing duties, erasure is restricted. The Gambling Commission expects relevant compliance data to remain available for at least five years after the relationship ends. Explain this to the player clearly and delete what you can.

Can AI answer data subject requests on its own?

We do not advise it. AI can classify, search and draft, but a trained person should approve scope, redactions and the final reply. That keeps decisions explainable and gives you an audit trail if the ICO or the Gambling Commission asks how a case was handled.

Sources

See Pitbot on your support workflow

Book a walkthrough tailored to your brands, channels, and compliance requirements.

Book a demo

Keep reading

All articles