Breach notification deadlines for gambling operators compared
A security incident at a gambling operator can trigger two separate reporting duties: one to the gambling regulator and one to the data protection authority. Deadlines range from immediate in Ontario and 24 hours in Nevada to five working days for the UK Gambling Commission and 72 hours under the GDPR.
Deadlines at a glance
| Jurisdiction | Report to | Trigger | Deadline | Source |
|---|---|---|---|---|
| Great Britain | Gambling Commission | Security breach affecting customer data confidentiality, or blocking account access for over 12 hours | As soon as reasonably practicable, within 5 working days | LCCP 15.2.1, key event 16 |
| Great Britain | ICO | Personal data breach likely to result in a risk to people | Without undue delay, where feasible within 72 hours | UK GDPR Art. 33 |
| Ontario | AGCO (iAGCO portal) | Gaming system security problem; breach of sensitive data | Immediate | AGCO notification matrix, row I1 |
| Canada (federal) | Privacy Commissioner | Breach of security safeguards with a real risk of significant harm | As soon as feasible | PIPEDA s.10.1 |
| Nevada | Gaming Control Board Chair | Cybersecurity incident | Within 24 hours of activating the response plan; initial report within 5 calendar days (or a meeting with the Chair instead, in the same window); written updates every 30 days until resolved | Regulation 5.260 |
| New Jersey | State Police, then customers | Breach of security of personal information | Customers "in the most expedient time possible and without unreasonable delay", after reporting to State Police | N.J.S.A. 56:8-163 |
| EU | Lead supervisory authority | Personal data breach likely to result in a risk | Without undue delay, where feasible within 72 hours | GDPR Art. 33 |
Two tracks: gambling regulator and privacy regulator
Gambling regulators and data protection authorities want different things. The Gambling Commission's guidance says the ICO "is primarily interested in breaches of personal information" while the Commission's interest is wider, including account unavailability and loss or corruption of critical gambling records. A ransomware attack that takes the site offline without exposing data may still be reportable to the gambling regulator.
When the clock starts
The ICO's 72 hours guide says for UK GDPR breaches: "The clock starts from when you discovered the breach, not when it actually happened." UK GDPR Article 33 also says that a notification made after 72 hours must give reasons for the delay. Nevada's clock runs from activating the incident response plan; the UK Gambling Commission's from becoming aware of the event.
Telling players
UK and EU GDPR require telling individuals without undue delay when a breach is likely to result in a high risk to them. PIPEDA requires notifying individuals on the same real risk of significant harm test as the report to the Commissioner. New Jersey requires customer disclosure after reporting to the State Police.
Prepare the map in advance
List every authority you may need to notify, the trigger, the deadline, the form or portal, and who signs off, and keep it with your incident playbook. Our incident response guide shows where it fits.
Questions about breach notification
Is the Gambling Commission deadline 72 hours?
No. Under LCCP 15.2.1 the Gambling Commission deadline is as soon as reasonably practicable and within five working days. The 72-hour deadline is the ICO's, for personal data breaches under UK GDPR.
Do I report to the regulator if no personal data was taken?
Possibly. In Great Britain, a security breach that blocks account access for over 12 hours is a key event even without data exposure. In Ontario, gaming system security problems must be reported immediately.
Sources
- Gambling Commission LCCP 15.2.1 and breach notification guidance; UK GDPR Arts. 33 and 34; ICO breach reporting pages
- AGCO Internet Gaming Notification Matrix v1.6; PIPEDA s.10.1
- Nevada Regulation 5.260 (January 2026) and Gaming Control Board Notice 2026-33; N.J.S.A. 56:8-163 as amended by P.L. 2019, c. 95
- GDPR Art. 33 (adopted text)
- All sources checked 24 October 2026.