Europe: security obligations for online gambling operators
At EU level, the main security obligation for gambling operators is the GDPR: appropriate security for personal data and breach notification within 72 hours. The NIS2 cybersecurity directive does not list gambling as a sector. Detailed technical security rules come from each national gambling regulator.
GDPR: security and breach notification
Under GDPR Article 33, "the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it" notify a personal data breach to the competent supervisory authority, unless the breach is unlikely to result in a risk to people. Article 34 requires telling the people affected without undue delay when the risk to them is high. Operators licensed in several countries usually deal with the lead supervisory authority where their main EU establishment is.
NIS2: gambling is not a listed sector
Directive (EU) 2022/2555 (NIS2) applies to entities in the sectors listed in its annexes. Annex I covers energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management, public administration and space; Annex II covers postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research. Gambling does not appear. Member states had to transpose the directive by 17 October 2024, according to the European Commission.
Two caveats. A gambling group could still fall within NIS2 if it separately provides a listed service, such as a digital infrastructure or digital provider service. And member states may extend national rules beyond the directive. Check the national law where you operate.
National gambling technical standards
EU countries regulate online gambling nationally, and their regulators publish technical requirements that often include security controls, certification by approved testing labs and incident reporting. We have not summarized each country here. Great Britain, outside the EU, is covered on our Great Britain page as an example of a detailed regime built on ISO/IEC 27001:2022.
Payment card data
Operators handling card data must meet PCI DSS through their contracts with acquirers and card brands; see our PCI DSS page.
Questions about EU security rules for gambling
Does NIS2 apply to online gambling operators?
Gambling is not a listed sector in NIS2 Annex I or II, so an operator is not in scope for gambling alone. It could be in scope if it also provides a listed service, and national laws may go further.
How long does an EU gambling operator have to report a data breach?
Under GDPR Article 33, without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people.
Sources
- Regulation (EU) 2016/679, Articles 33 and 34 (adopted text via legislation.gov.uk)
- Directive (EU) 2022/2555, Annexes I and II (EUR-Lex); European Commission, 28 November 2024
- All sources checked 24 October 2026.