iGaming data retention: build a defensible schedule
A retention schedule should specify which records are kept, why, for how long and from which starting event. Do not apply one retention period to every gambling record. Privacy obligations and sector-specific retention duties must be assessed together.
iGaming Cyprus · Last updated:
Why is one global retention period inadequate?
The European Commission explains that storage periods should reflect the processing purpose and applicable legal obligations. Customer verification, payment records, marketing permissions and support material can have different purposes and requirements.
Map records by category and jurisdiction. A rule triggered by the end of a customer relationship is different from one triggered by a transaction date. If the starting event is undefined, the system cannot calculate the intended deletion date reliably.
What fields should the schedule contain?
Use a practical register that connects the legal assessment to the system implementing it.
| Field | Purpose |
|---|---|
| Record category and system | Identify what is actually stored |
| Purpose and legal basis | Explain why it is retained |
| Period and starting event | Make the retention calculation reproducible |
| Access and deletion method | Define operational safeguards |
| Hold or exception | Record a justified reason to suspend deletion |
| Owner and review date | Keep the rule accountable and current |
How should AML requirements be integrated?
The UKGC’s casino guidance includes a five-year CDD recordkeeping reference linked to the end of the relationship or last premises visit in its context. That example should not be copied to every jurisdiction or every record type.
Identify the actual obligation applying to each entity and activity, then translate it into a system rule. If multiple duties overlap, record the reasoning for the selected period and any constraints. Obtain specific advice where the requirements appear to conflict.
What should happen when a legal hold applies?
Define who can place a hold, which records it covers and when it will be reviewed. A dispute or investigation may justify preserving relevant material, but it should not become an undocumented reason to keep all data forever.
Keep the original retention rule visible beneath the hold. When the hold ends, reassess the affected records and perform the required action. Record the decision so the business can explain why a particular item remained available longer than normal.
How should deletion be tested?
Check live systems, exports, vendor copies and backups as appropriate to the architecture. Deleting one database row may leave the same document in a support attachment or shared folder.
Test a sample record through the full lifecycle, including expiry and exception handling. Keep evidence that scheduled actions occur. A retention policy is incomplete if nobody knows which system performs deletion or how failures are detected.
Frequently asked questions
No. Assess the purpose and applicable legal retention obligations for each record.
That is not a meaningful schedule. Define the purpose, period and any specific justified exception.
Sources and scope
This guide was prepared with AI assistance using the linked sources. It provides general information and practical preparation suggestions, not a legal opinion for a particular business. No personal professional review is claimed.
Get the right structure for your case
Book a free, no-obligation consultation. We’ll confirm the right Cyprus company + licence setup and a fixed fee for your business.