Contents

• Privacy policy
• 1.
  General
• 2.
  Financial requirements
• 3.
  Protection of children and other vulnerable persons
• 4.
  ‘Fair and open’ provisions
• 5.
  Marketing
• 6.
  Complaints and disputes
• 7.
  Gambling licensees’ staff
• 8.
  Information requirements
• 9.
  Gaming machines in gambling premises
• 10.
  Assessing local risk
• What is personal data and special category data?
• What personal data do we collect, for what purpose, and what is the basis for doing so?
• Licence applicants and National Lottery vetting
• People who already hold an operating and or personal licence
• People we are investigating/regulatory action
• Complainant data
• Gambling Commission Consultations
• What are cookies?
• Our use of cookies
• How we use information website and digital service users provide us with
• User research
• Links to other websites
• How long we keep the information
• Keeping your personal information secure
• Obtaining data from third parties
• Who we share personal data with
• Your rights
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to object processing
• Law enforcement processing
• Accessing your personal data
• Overseas transfers
• Changes to this privacy statement
• Stakeholder events privacy notice
• How to contact us
• Recruitment privacy notice 2024
• Monitoring social media
• How to complain privacy policy
• Do you need any extra help?
• Regular Feed of Operator Core Data (ROCD) (Pilot Project)

What personal data do we collect, for what purpose, and what is the basis for doing so?

We collect and process personal data based on one or more of the following legal bases:

• Consent: the individual has given clear consent for us to process their personal data for a specific purpose
• Contract: the processing is necessary for a contract we have with the individual or their organisation, or because they have asked us to take specific steps before entering into a contract
• Legal obligation: the processing is necessary for us to comply with the law (not including contractual obligations)
• Vital interests: the processing is necessary to protect someone’s life
• Public task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law.

We collect and process special categories of personal data based on one or more of the legal bases set out above and where one of the separate conditions for processing applies, the most likely being: processing is necessary for reasons of substantial public interest, on the basis of UK law and is proportionate to the aim pursued, or processing is necessary for the establishment, exercise or defence of legal claims.

As a regulatory body, most of the personal data that we collect and process is data relating to our regulatory functions and responsibilities. Therefore, for the most part (and for the reasons set out below), when we are processing data it will be on the basis that it is necessary for the performance of a task carried out in the public interest and/or in exercising our statutory functions. We have sought to explain how this works below and also what other lawful bases apply to our processing of data in the relevant categories.

We will also be acting as a prosecutor in relation to certain gambling offences, and processing data for this purpose. The effect of this is picked up below.

Previous page
What is personal data and special category data? Next page
Licence applicants and National Lottery vetting