Report

Annual report and accounts 2023 to 2024

The Gambling Commission's 2023 to 2024 Annual report and accounts. For the period 1 April 2023 to 31 March 2024.

---

Published
17 October 2024

Last updated
22 October 2025 - Changes

Document actions
Print or save (opens in new tab)

8 - Retention period

Records of identification and verification of customers must be kept for a period of five years after the business relationship with the customer has ended, for example where the customer closes their gambling account with the operator or ceases to visit or use the casino.¹⁵⁸

Supporting records must be retained for a period of 5 years from the date the business relationship ended.¹⁵⁹

Upon expiry of the five-year retention period, any personal data must be deleted unless:

• the casino operator is required to retain records containing personal data by or under any law or the purposes of any court proceedings
• the subject of the data has agreed to the retention of the data, or
• the casino operator has reasonable grounds for believing that records containing the personal data need to be retained for the purposes of legal proceedings.¹⁶⁰

Records of internal and external reports on suspicious activity should be retained for five years from when the report was made.

References

¹⁵⁸ Regulation 40(3).
¹⁵⁹ Regulation 40(3).
¹⁶⁰ Regulation 40(5).

---

Last updated: 22 October 2025

Show updates to this content

Updated in line with revision 5 of the guidance.