iGaming data breach response: assess, record and notify

When does a security incident become a data breach?

The EDPB describes a personal-data breach broadly, including accidental events. A misdirected verification document or loss of access to personal data can therefore require assessment alongside more obvious intrusions.

Give staff a simple internal reporting route. The first report should identify what happened, when it was noticed, which systems or records may be involved and who is responding. Avoid requiring the reporter to decide the final legal classification before escalating.

How should the first response be organised?

Contain the incident while preserving the evidence needed to understand it. Assign technical, privacy and operational owners so urgent actions do not proceed in disconnected workstreams.

• Record the awareness timeline and facts currently known.
• Limit further exposure using appropriate containment steps.
• Identify affected data categories and individuals where possible.
• Assess potential consequences and existing safeguards.
• Determine regulator, individual and contractual notification duties separately.
• Record decisions and update the assessment as evidence changes.

What does the 72-hour rule mean?

Under the GDPR notification framework, a controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of awareness unless the breach is unlikely to result in a risk to individuals’ rights and freedoms. Communication to individuals has a separate high-risk test and relevant exceptions.

The EDPB’s guidance addresses incomplete information and phased notification. The practical lesson is to make and document the assessment promptly rather than assume the deadline begins only when every technical detail is known.

Which gaming-specific dependencies need attention?

An incident may affect identity documents, player balances, account access or customer communications. Coordinate the privacy response with payment, security and customer-support teams while limiting unnecessary access to sensitive information.

Gaming-regulator reporting and supplier-contract notifications may be separate from data-protection notifications. Use a recipient-and-deadline matrix so one completed notification is not mistaken for completion of every obligation.

What should the post-incident review produce?

Document the cause, affected scope, decisions, corrective action and evidence of remediation. Review whether access controls, logging, supplier escalation or staff training failed.

Rehearse a scenario such as a verification file sent to the wrong recipient. Check how quickly it reaches the right people and whether the team can assess the data and risks. A small tabletop exercise can expose missing contact details and decision authority before a larger event.