Security requirements by market
What gambling regulators and related laws require of operators' information security, with each requirement tied to its official source and dated.
At a glance
| Market | Security framework | Independent testing | Breach notice to gambling regulator |
|---|---|---|---|
| Great Britain | RTS section 4, based on ISO/IEC 27001:2022 Annex A | Annual security audit; first within 6 months of license | Within 5 working days (LCCP 15.2.1) |
| Ontario | A recognized industry standard framework (5.01) | Regular independent assessments (5.11) | Immediate (notification matrix I1) |
| Michigan | ISO 27001 or similar policy review | Within 90 days of launch, then annual, with penetration tests | Not found in R 432.638 |
| Nevada | Best practices such as CIS v8, ISO/IEC 27001, NIST SP 800-53 | Annual review for Group I licensees | Within 24 hours (Reg. 5.260) |
| EU | GDPR security; NIS2 does not list gambling | National rules vary | National rules vary; GDPR 72 hours to data authority |
All rules pages
Great Britain: RTS security and annual audits
RTS section 4 built on ISO/IEC 27001:2022, the annual independent security audit, and the five-working-day duty to report security breaches.
Ontario: AGCO security standards
What the AGCO Registrar's Standards require on IT frameworks, monitoring and independent assessments, and the immediate notification rule for breaches.
US states: security audits and incident notice
Annual independent security assessments in New Jersey, Pennsylvania and Michigan, and Nevada's 24-hour cyber incident notice rule.
Europe: GDPR and NIS2 for gambling
GDPR's 72-hour breach notification, NIS2's sector lists (gambling is not one), and where national gambling regulators add technical rules.
Breach notification deadlines compared
One table of who to tell and how fast after a security incident: gambling regulators and data protection authorities in GB, Ontario, the US and the EU.
PCI DSS v4.0.1 for gambling operators
Where PCI DSS stands in 2026, the dates that matter, and how card data security fits with gambling regulators' audits.
Rules pages are reviewed at least every three months. See how we check sources or report a change via the contact page.