GDPR для gambling operators

GDPR compliance для gambling — сочетание general GDPR requirements и specific industry constraints.

Data collected

Identity: full documents (KYC). Financial: bank details, cards, crypto wallets. Behavioral: comprehensive gambling activity. Health: sometimes через RG interactions. Location: IP, GPS. Communication history. Все — sensitive category.

Legal basis

Contract performance: providing gambling services. Legal obligation: AML, KYC, tax reporting. Legitimate interest: fraud prevention, RG. Consent: marketing только с opt-in. Vital interests: RG interventions. Multiple bases обычно required.

Retention conflict

Data minimization vs AML 5+ years retention. RG data retention 5 years. Financial records 7–10 years. Marketing: right to erasure BUT AML overrides. Documented policies обязательны. Purpose-limited retention.

Cross-border

EU to Curaçao: adequacy decision нет — SCCs required. EU to third countries: SCCs, DPIA. Multi-region operations: comprehensive data mapping. Data localization requirements в некоторых juris. Complex arrangements для global operators.