Data Protection in Regulated Industries: The GDPR Obligations Operators Miss

The General Data Protection Regulation is now six years into its enforcement cycle, and the pattern of regulatory action is clear enough to draw reliable conclusions about where regulated businesses are most commonly failing. The volume and scale of fines has increased significantly since 2021. The sectors attracting most enforcement attention include financial services, telecoms, and — with increasing frequency — gaming and entertainment. The common thread in enforcement actions is not ignorance of GDPR; it is underestimation of its practical requirements.

Regulated gaming operators face a particular challenge. They are subject to GDPR obligations simultaneously with gaming regulatory CDD requirements and AML obligations — and those obligations overlap in ways that create tension without explicit resolution in most operators' data governance frameworks. Understanding where the conflicts arise, and how to manage them, is the starting point for meaningful GDPR compliance in a regulated gaming environment.

Lawful Basis: The Complexity Operators Miss

The most foundational GDPR concept — lawful basis — is also the most frequently mismanaged. Most regulated businesses identify a lawful basis for processing customer data at the account opening stage and do not revisit that question as the processing activities change throughout the customer relationship. This creates silent lawful basis gaps for processing activities that were added after initial framework development.

For regulated gaming operators, the relevant lawful bases and their common misapplication:

Retention Schedules: The Paperwork That Prevents Enforcement

Data retention is a storage limitation obligation under GDPR Article 5(1)(e): personal data must not be kept for longer than necessary for the purpose for which it was collected. In regulated gaming, the retention question is complicated by overlapping obligations that impose minimum retention periods for different data categories — AML records, responsible gambling assessments, game play records, financial transaction records.

The practical failure in most operators is not that they retain data too long, but that they retain data indefinitely without a documented retention schedule, and they cannot demonstrate that the retention period for any specific data category has been assessed and justified. This is a consistent regulatory finding in ICO investigations and a pattern that enforcement actions across Europe have identified.

A defensible data retention framework covers:

• Identification of every category of personal data processed by the organisation
• The lawful basis for processing each category
• The minimum retention period required by any applicable legal or regulatory obligation
• The maximum retention period justified by the processing purpose
• A documented process for deletion or anonymisation at the end of the retention period
• Evidence that the deletion process is actually operating — not just described in a policy

Data Subject Access Requests: The Operational Test

The volume of Data Subject Access Requests received by regulated gaming operators has increased significantly since 2020. The combination of politically charged departures, responsible gambling self-exclusion disputes, and AML-adjacent customer relationship terminations creates a specific pattern of DSARs that are more complex than typical consumer requests and carry higher litigation risk.

The operational failures in DSAR handling that most commonly create regulatory exposure:

• Missing the deadline: The 30-day response requirement is strictly interpreted. Where the deadline cannot be met, the extension must be communicated within the initial 30-day period with clear reasons — not retrospectively.
• Incomplete disclosure: Operators frequently fail to include all categories of personal data in DSAR responses — omitting internal notes, risk ratings, responsible gambling flags, or surveillance records that constitute personal data about the subject. Incomplete responses are themselves a breach of the right of access.
• Third-party data redaction: Where DSAR responses contain data relating to third parties, that data must be redacted before disclosure. Failure to redact is itself a breach. Excessive redaction that removes the data subject's own information under cover of third-party protection is also a failure.
• AML restriction misapplication: GDPR allows restriction of DSAR responses where disclosure would prejudice crime prevention or detection, including AML reporting. This exemption applies to specific information — the existence of a SAR — and must be applied on a case-by-case basis, not as a blanket policy to avoid disclosure of AML-related records.

Breach Notification: The 72-Hour Clock

The 72-hour breach notification requirement under GDPR Article 33 is one of the most operationally demanding provisions of the regulation. Seventy-two hours from becoming aware of a breach is not enough time to fully investigate the incident, assess its scope, or determine its impact with certainty. The requirement is to notify with the information available at the time, updating the notification as further information becomes available.

Most regulated businesses have a documented incident response process that includes data breach identification and notification steps. The operational gap is typically in the triage layer — the process for identifying whether a security incident, data loss event, or unauthorised disclosure constitutes a "personal data breach" within the GDPR definition, and whether it is likely to result in "risk to the rights and freedoms of individuals" triggering the notification obligation.

The threshold question requires a documented assessment methodology. Not every data incident is a notifiable breach — but the assessment needs to be documented in every case, and notifications need to be made promptly in cases where the threshold is met. The ICO's enforcement record shows that late notification — notification beyond 72 hours without adequate justification — is treated as a distinct failure separate from the underlying breach.

Responsible Gambling Data: The Special Category Intersection

Responsible gambling data collected by gaming operators — self-exclusion records, spend limit settings, responsible gambling assessments, referrals to support services — may constitute special category personal data under GDPR Article 9. Data that reveals health condition, addiction vulnerability, or participation in addiction support services is health data, which attracts the highest level of protection under the regulation.

The practical implications for gaming operators are significant. Special category data requires an explicit legal ground for processing under Article 9 in addition to the Article 6 lawful basis. The processing must be documented with specific justification. Access controls must reflect the sensitivity of the data — responsible gambling records should not be accessible to operational staff who have no legitimate need to review them. Retention periods for health-adjacent data should be assessed against the specific sensitivity, not the generic player record retention schedule.

The intersection with responsible gambling regulatory obligations creates an additional tension: operators are required by gaming regulation to maintain and act on responsible gambling records, while GDPR requires that the same records are processed with specific legal grounds, strict access controls, and purpose limitation. Both obligations can be satisfied, but only if the compliance framework explicitly addresses the intersection.

This article reflects the operational perspective of the Wise Key Solutions founding team, drawing on CIPP/E qualified experience in data protection compliance for regulated industries. It does not constitute legal advice. Operators should obtain qualified legal counsel for specific GDPR compliance questions.