Ask a casino to delete your personal data
This guide explains how an Irish player can ask an online casino to erase the personal data it holds, using the right to erasure in Article 17 of the GDPR. It covers what an operator must delete, what anti-money-laundering law obliges it to keep, how to write and send the request, and where to complain when the answer is late or incomplete. It is written for anyone closing an account for good, whether the reason is privacy, a change of habits or a dispute that has run its course.
What the right to erasure gives you
Article 17 of the GDPR lets you ask a data controller to erase your personal data without undue delay where one of the listed grounds applies. The Data Protection Commission, which supervises the GDPR in Ireland, sets those grounds out on its own guidance page, and we checked the wording there rather than relying on operator summaries.
For a casino customer, three of the grounds tend to matter most: the data is no longer needed for the purpose it was collected for, you withdraw consent and there is no other lawful basis, or you object to processing for direct marketing. The last of these is absolute, so a request to stop marketing has to be honoured in full.
The right is real, but it is narrower than the phrase “right to be forgotten” suggests.
Erasure does not apply where processing is needed to comply with a legal obligation, and for gambling operators that exception carries most of the weight. Section 60 of the Data Protection Act 2018 adds further restrictions for important public-interest objectives, and section 64 of the Gambling Regulation Act 2024 deals specifically with restricting data protection rights in the gambling context. A casino can therefore lawfully refuse to delete some records while still being obliged to delete others, and the reply you receive should say which is which. A blanket refusal with no legal basis named is not a proper answer under the GDPR, and it is the first thing worth challenging.
The controller must also tell each recipient it shared your data with about the erasure, unless that proves impossible or involves disproportionate effort.
What a casino deletes and what it must keep
| Data type | Usual outcome | Legal basis | How long |
|---|---|---|---|
| Marketing lists and preferences | Deleted | GDPR Article 21 objection | Without undue delay |
| KYC identity documents | Retained | CJA 2010, section 55(2) | At least 5 years after relationship ends |
| Deposit and withdrawal history | Retained | CJA 2010, section 55(3) | At least 5 years after each transaction |
| Self-exclusion record | Typically retained | Responsible gambling obligations | Per operator policy |
Sending an erasure request that works
A valid request needs no special form and no fee, and it does not have to mention Article 17 by number, although doing so removes any doubt about what you are asking for. What it does need is enough detail for the operator to find your account and confirm that the request really comes from you.
Send it to the data protection officer, whose contact address should appear in the casino’s privacy policy, rather than to live chat. A chat agent can close an account, but closing an account and erasing data are different acts, and many players discover months later that a closed account was simply marked dormant.
The deadline is one month from receipt.
Citizens Information confirms that a controller may extend this by a further two months for complex requests, provided it explains the extension in writing within the first month. Keep a copy of everything you send and receive.
Six steps to request deletion
The sequence below follows the order in which the GDPR and the Irish money-laundering rules come into play, from withdrawing your balance to the point where a complaint becomes the next move.
- Step 1
Withdraw any remaining balance first
Request a withdrawal of any funds before asking for erasure. Once data is deleted, proving an outstanding balance becomes much harder, and a pending source-of-funds check may hold up both the payout and the deletion. - Step 2
Find the operator's data protection contact
Open the privacy policy and locate the data protection officer or privacy email address. Note the legal entity named as controller, since that company, not the brand name, is the one your request is addressed to. - Step 3
Write a clear Article 17 request
State that you are requesting erasure under Article 17 GDPR and objecting to direct marketing under Article 21. Give your account username and registered email, and ask which records will be kept and on what legal basis. - Step 4
Verify your identity when asked
The operator may ask you to confirm identity before acting. Reply from the registered email address and supply only what is needed; there is rarely any reason to send a fresh copy of your passport. - Step 5
Track the one-month deadline
Note the date your request was received. The controller has one month to respond, or must tell you within that month if it is extending by up to two further months, and why. - Step 6
Escalate to the regulator if needed
If the reply is late, incomplete or names no legal basis for retention, complain to the Data Protection Commission, or to the supervisory authority where the controller is established if it is outside Ireland.
Where the operator sits changes your route
The GDPR applies to any operator that offers services to people in Ireland, wherever the company is based, but the regulator you complain to and the protection you can expect are not the same in every case.
Where the controller is established in the EU, its lead supervisory authority will usually be the data protection regulator of that member state, and the Data Protection Commission in Dublin can pass your complaint on. Outside the EU, an offshore gambling licence says nothing about data protection, and enforcement against a company with no EU presence is slow at best.
Do not assume that a foreign gambling licence protects your data in the way an Irish regulator would.
Under the Gambling Regulation Act 2024, the Gambling Regulatory Authority of Ireland is taking over licensing in stages, through commencement orders rather than all at once. Section 45 provides for a National Gambling Exclusion Register that Business to Consumer licensees will view in real time, and section 47 lets a person ask for removal of their entry after six months. We did not find confirmation that the register is operational, so until it is, self-exclusion still has to be arranged with each operator directly, and section 48 preserves that route. That matters for erasure: an exclusion record is one of the few things a player may actively want kept.
Deleting data or self-excluding
Players often ask for erasure when what they want is to stop gambling with that operator. The two requests do different things, and the rows below set them side by side.
Erasure request | Self-exclusion |
|---|---|
| Removes marketing and non-required data | Keeps your details so the block can work |
| Does not stop you opening a new account | Operator must refuse a new account |
| Governed by the GDPR and the Data Protection Commission | Governed by operator terms and gambling rules |
| Ends marketing contact entirely | Should also end marketing contact |
When the casino refuses or ignores you
A refusal is lawful only where the operator names a ground the GDPR or Irish law actually provides, and the reply should identify that ground rather than gesture at “regulatory requirements”.
If the casino cites section 55 of the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, it is entitled to keep identity documents and transaction records for not less than five years after the relationship or transaction ends. A Garda direction under section 55(4A) can extend that by up to five more years in an investigation. The same section, at subsection (7B), then requires the personal data kept solely for those purposes to be deleted when the period expires, so the five years is a floor for retention and a ceiling for any reason based on that Act alone.
Silence is easier to deal with.
If a month passes with no reply and no notice of extension, complain to the Data Protection Commission at dataprotection.ie, attaching your request and proof of the date it was sent. The DPC has written to controllers in published case studies for missing the Article 12(3) deadline, which tells you the timing rule is enforced in practice and is worth citing in your complaint.
Related Terms
Questions about deleting casino data
Can a casino refuse to delete my data?
Yes, partly. Anti-money-laundering law requires operators to keep identity and transaction records for at least five years, but marketing data and anything without a legal basis for retention should be erased.
How long does the casino have to reply?
One month from receiving your request. For complex requests it can extend by two further months, but it must tell you, with reasons, within the first month.
Is closing my account the same as deleting my data?
No. Closing an account often leaves it dormant with your data intact. Erasure needs a separate written request under Article 17 GDPR, ideally sent to the data protection officer.
Does the GDPR apply to casinos based outside the EU?
It applies to operators offering services to people in Ireland, but enforcing it against a company with no EU presence is difficult, and an offshore gambling licence adds no data protection.
Will erasing my data cancel a self-exclusion?
It can weaken one, because the operator needs your details to block new sign-ups. If you want to stay excluded, say in your request that the exclusion record must be kept.
More about online casinos
What we look for first in a reply is whether the operator separates these rows or lumps everything under one retention clause. Section 55(7B) of the 2010 Act requires deletion once the AML period expires, so a casino keeping KYC files indefinitely has no basis in that Act for doing so.