Complain to the DPC about a casino

The DPC expects you to raise the problem with the casino first, and its own guidance says that a complaint should arrive with copies of the correspondence exchanged between you and the organisation. A complaint without that trail is the most common reason a case stalls at the start.

In most casino cases the first letter is a subject access request under Article 15 of the GDPR, which entitles you to a copy of the personal data the operator holds, including KYC documents, account notes and the records behind any decision to restrict your account. No particular form is required, so an email to the operator’s data protection officer is enough, provided it identifies you and the account.

Keep the clock in mind.

Under Article 12(3) the operator must respond within one month of receiving the request, and it can extend that by up to two further months for a complex request, but only if it tells you so, with reasons, before the first month runs out. The DPC’s guidance for controllers adds that the month counts weekends and public holidays, and that it begins on the day a valid request was received rather than the day someone in the casino got round to reading it. Once that deadline has passed without a proper answer, or the answer refuses data you believe you are entitled to, you have the basis for a complaint.

The Commission deals with how personal data is processed, which covers ignored access requests, refusals to erase data, marketing sent after you withdrew consent, and documents exposed in a breach. It does not decide whether a casino owes you a withdrawal, whether a bonus term was fair or whether a game was rigged.

That distinction matters most when a withdrawal is held for KYC or source-of-funds checks. The DPC can examine whether the operator collected more documents than it needed or kept them insecurely, but it will not order the payout, because the dispute over the money is a gambling matter.

Erasure requests are a frequent source of disappointment. An operator that is subject to anti-money-laundering law is generally obliged to keep identity and transaction records for a set period after the relationship ends, so a refusal to delete those particular records is not automatically a breach, although the operator should still explain the legal basis and stop using the data for marketing.

Gambling disputes in Ireland are moving to the Gambling Regulatory Authority of Ireland under the Gambling Regulation Act 2024, and which of its complaint powers apply at any moment depends on the commencement orders made under that Act, so check the GRAI’s own site for what is currently in force.

Many casinos taking Irish players are established in another EU state, and under the GDPR’s one-stop-shop mechanism the authority where the operator has its main establishment usually leads the investigation. That does not stop you complaining in Ireland.

Article 77 gives you the right to lodge a complaint with the supervisory authority of the member state where you habitually reside, so the DPC can take your complaint, pass it to the lead authority and act as your point of contact, while the decision itself is made elsewhere and often takes longer as a result.

Operators outside the EU are harder.

A casino that targets Irish players from outside the Union is still bound by the GDPR under Article 3(2), but enforcement against a company with no EU presence is limited in practice, and a gambling licence from a regulator such as Curaçao or Kahnawake does not change that, because a gambling licence says nothing about data protection oversight. Readers sometimes assume a foreign licence gives them protections equivalent to Irish ones, and on data matters it plainly does not.

The DPC is not the only remedy. Article 79 of the GDPR also gives you a right to go to court, and the comparison below sets the two routes against each other on the points readers ask about most.

Once the webform is submitted you receive a DPC reference number, and every later message should quote it through the existing-case option rather than opening a new case.

The Commission states that it will usually contact the organisation and share the details of your concern, including your name and the factual background, so the casino can confirm whether it processes your data and respond. In many access cases that contact alone produces the data you asked for, and the matter is resolved without a formal decision.

Where it is not, the DPC can examine the complaint further and, under the Data Protection Act 2018, remind the operator of its obligations or move to formal enforcement. We could not confirm a published standard timescale for complaint handling, so we do not quote one here.

Keep a copy of everything you send.