A gambling account produces a denser personal record than almost any other consumer service. Identity documents, financial evidence, every wager with a timestamp, automated risk scores, marketing segments, and free-text notes written by staff about you. You have a right to a copy of essentially all of it, the request costs nothing, and it takes about ten minutes to send. Very few people ever do.
What is in the file
- Identity and verification material — the documents you uploaded, plus the results of the checks run on them.
- Financial evidence — anything submitted for a source of funds review, and the internal assessment written on it.
- The full wagering log — every stake, outcome, session start and end, and the device and address it came from.
- Automated scoring — affordability indicators, risk bands, markers of harm, and whatever segmentation drives the offers you see.
- Marketing profile — the segments you sit in, the campaigns you were sent, and the consent record behind them.
- Free-text notes — chat transcripts, call notes, and responsible-gambling interaction records. This is the category people find most surprising and most worth reading.
- Self-exclusion and limit history — every limit you set, changed or asked to remove, with dates.
The request
Under UK data protection law this is a subject access request. There is no prescribed format. It does not have to use the phrase, it does not need a reason, and the operator cannot charge for it in ordinary circumstances. Send it to the data protection contact in the privacy policy, from the address the account is registered to.
Subject: Subject access request — account [username], [registered email]
I am making a subject access request under the UK GDPR for a copy of the personal data you hold about me, together with the supplementary information required by Article 15.
Please include, without limiting the scope of the request: identity and verification records; any source of funds or affordability assessment and the conclusions recorded; my complete transaction and wagering history; any automated risk, affordability or harm scoring applied to my account, including the categories used; marketing segments and consent records; free-text notes on my account, including chat transcripts and responsible-gambling interaction records; and my limit and self-exclusion history.
Please also confirm the retention period applied to each category and the recipients or categories of recipient to whom the data has been disclosed.
I can verify my identity by [method]. Please confirm receipt.
The clock
- The response is due within one month of receipt.
- That can be extended by up to two further months where the request is complex or where you have made several — but the operator has to tell you about the extension, and why, inside the original month.
- The clock starts when the operator has what it reasonably needs to identify you. Send identification with the request rather than waiting to be asked.
- If nothing arrives, the escalation is the Information Commissioner's Office, not the Gambling Commission. Data protection and gambling regulation are separate regimes with separate regulators.
Where it is genuinely useful
Three situations, in our experience. In a disputed balance, the wagering log and the internal notes are the evidence the operator would otherwise be the only party holding. In a marketing complaint, the consent record answers the question of what you were held to have agreed to and when. And after a self-exclusion that failed to hold, the limit history and the interaction notes are what establish the timeline.
It is also worth knowing what the verification stage collects in the first place, since much of the file originates there — GambleDragon covers what a sign-up verification flow gathers before you have placed a single bet.
What you can also ask for
A copy is the most useful right, but it is not the only one. You can ask for inaccurate data to be corrected, object to processing for direct marketing — which must be honoured — and in defined circumstances ask for erasure. Erasure is the one most likely to be refused, and often legitimately: regulatory record-keeping and self-exclusion registers depend on the operator retaining certain data whether or not you would prefer otherwise. A refusal on those grounds is normal. A refusal without a stated ground is not.
FAQ
Can the operator charge me for this?
Not in ordinary circumstances. A fee, or a refusal, is only available where a request is manifestly unfounded or excessive — and the operator has to justify that characterisation rather than merely assert it.
Will they hand over internal staff notes about me?
Notes recording opinions about you are your personal data and are generally in scope. Material can be redacted where it would reveal a third party's personal data, but "it is internal" is not on its own a valid exemption.
Does closing my account delete the file?
No. Closure ends the relationship; retention obligations continue to run, and some categories are held for years afterwards. This is one of the specific things worth asking the operator to state.
Sources
- Information Commissioner's Office — Your right to get copies of your data (accessed 2 August 2026)
- Gambling Commission — Public and players guidance (accessed 2 August 2026)