What Data Does GamStop Store? Privacy and Retention Guide

Your Exclusion Leaves a Data Trail

When you register with GamStop, you hand over personal information that is stored, processed, and shared with gambling operators for the duration of your exclusion — and in some cases, well beyond it. GamStop needs this data to function. Without your name, date of birth, and address, operators cannot match you against the exclusion register, and the entire system fails.

But for privacy-conscious users, the question of what GamStop stores, who it shares the data with, how long it is retained, and what rights you have over it is worth examining. The answers are mostly reassuring, but they come with nuances that are not immediately obvious from the registration form.

Data Collected at Registration

GamStop collects a defined set of personal data when you register. The core fields are your full name, date of birth, email address, residential address, and postcode. You also provide a phone number and choose a password for your online account. These are the minimum details required for the system to function — they enable identity verification through TransUnion and allow operators to match your details against their customer databases.

Beyond the core fields, GamStop records the date and time of your registration, the exclusion period you selected, and any subsequent interactions with your account — extensions, removal requests, status changes. This operational data creates a timeline of your engagement with the scheme, which GamStop uses for internal administration and, if necessary, for responding to enquiries from you or from regulatory bodies.

GamStop does not collect financial information. It does not know your bank details, your gambling history, your transaction records, or how much you have won or lost. It has no access to your accounts with individual operators and no visibility into your gambling behaviour before or after exclusion. The data GamStop holds is identity data and exclusion data — nothing more.

If you provided additional information during interactions with GamStop’s support team — for example, if you called to discuss a verification issue and described your personal circumstances — that information may be recorded in call notes or case files. GamStop’s support team maintains records of customer interactions for quality assurance and dispute resolution purposes. These records are subject to the same data protection rules as your registration data.

How Data Is Shared with Operators

GamStop shares your personal data with every UKGC-licensed gambling operator. This is the fundamental mechanism of the scheme — operators need your details to match you against their customer databases and block your access. The data shared includes your name, date of birth, and address. It may also include your email address and phone number, depending on the data fields the operator uses for customer matching.

The sharing occurs through GamStop’s central database, which operators access via an API or through regular data extracts. The frequency of access varies by operator — some check the database in real time whenever a customer logs in or registers, while others sync in batches at least once every 24 hours. The data itself is transmitted through encrypted channels, and operators are contractually required to handle it in accordance with UK data protection law.

Operators receive your data for a specific purpose: to enforce your self-exclusion. They are not permitted to use GamStop data for marketing, customer profiling, or any purpose unrelated to self-exclusion compliance. If an operator were to use your GamStop data to target you with marketing — or to share it with third parties for commercial purposes — that would constitute a breach of both the data-sharing agreement and UK GDPR.

After your exclusion is removed, GamStop notifies operators that you are no longer on the register. However, the notification also informs operators that you were previously self-excluded. This previous-exclusion flag persists for seven years after removal. During that period, operators know that you were once on the GamStop register, even though the active exclusion has ended. They can use this information to apply enhanced responsible gambling measures — additional identity checks, lower default deposit limits, or proactive customer interaction — at their discretion.

The seven-year post-removal flag is one of the aspects of GamStop’s data sharing that users find most surprising. Your exclusion ends, but the record of it follows you through the UKGC-licensed market for another seven years. GamStop frames this as a protective measure — it allows operators to be more vigilant with customers who have a history of self-exclusion. From a privacy perspective, it means your gambling history includes a long-lasting marker that you did not necessarily anticipate when you first registered.

Data Retention Periods

GamStop’s data retention policy determines how long your personal information is held after your exclusion ends. The policy aligns with the organisation’s obligations under UK GDPR, which requires that personal data be kept only for as long as necessary for the purpose it was collected.

During your active exclusion — whether the original period, an extension, or the seven-year auto-extension — GamStop retains all your registration data. This is necessary for the scheme to function. Your data must remain on the register for operators to continue blocking your access.

After removal, GamStop retains your data for the seven-year post-removal period during which operators are informed of your previous self-exclusion status. This retention is justified by GamStop as necessary for the ongoing protection of the individual — enabling operators to apply enhanced scrutiny to returning customers — and as a regulatory requirement aligned with the UKGC’s social responsibility framework.

Beyond the seven-year post-removal period, GamStop’s retention policy becomes less precisely defined in public-facing documentation. The organisation states that data is retained in accordance with its legal obligations and legitimate interests, which may include record-keeping for regulatory compliance, dispute resolution, and statistical analysis. In practice, this means that some form of your data may be held by GamStop for a considerable period after your exclusion has fully concluded.

If you want a precise answer about how long your specific data will be retained, you can submit a data retention enquiry to GamStop directly. Under UK GDPR, they are obligated to provide this information upon request.

Your Rights Under UK GDPR

As a UK resident whose personal data is processed by GamStop, you have a set of rights under the UK General Data Protection Regulation and the Data Protection Act 2018.

You have the right to access your data. You can submit a Subject Access Request to GamStop, asking them to provide a copy of all personal data they hold about you. GamStop must respond within one calendar month. The SAR will reveal what data GamStop has stored, how it has been processed, and who it has been shared with.

You have the right to rectification. If any of the data GamStop holds about you is inaccurate — a misspelled name, an outdated address, an incorrect date of birth — you can request that it be corrected. This is particularly relevant if data inaccuracies are causing verification problems during the removal process.

You have the right to request erasure in certain circumstances. However, this right is not absolute. GamStop can refuse an erasure request if it has a legitimate basis for retaining the data — which, during an active exclusion, it does. After the exclusion has fully concluded and all retention periods have expired, an erasure request stands on stronger ground, though GamStop may still argue that regulatory compliance justifies continued retention.

You have the right to lodge a complaint with the Information Commissioner’s Office if you believe GamStop has mishandled your data. The ICO can investigate and, if appropriate, take enforcement action. This is the escalation route if GamStop does not respond satisfactorily to a SAR, refuses a reasonable rectification request, or retains data beyond what is justifiable.

Your Data Outlasts Your Exclusion

The practical takeaway is that registering with GamStop creates a data relationship that extends years beyond the active exclusion period. Your details are shared across the entire UKGC-licensed gambling industry, retained by GamStop for an extended period, and used to flag your previous self-exclusion status to operators long after the exclusion itself has ended.

For most users, this is an acceptable trade-off. The data processing is necessary for the scheme to work, and the post-removal flag exists to provide additional protection. But it is worth going in with open eyes. When you register with GamStop, you are not just making a decision about your gambling access. You are making a decision about your personal data that has consequences lasting a decade or more.