Great Britain: Gambling Commission security requirements
Remote gambling operators licensed in Great Britain must meet security requirements based on ISO/IEC 27001:2022, pass an annual independent security audit, and report security breaches affecting customer data to the Gambling Commission within five working days. The route is license condition 2.3.1, which makes the technical standards binding.
How security becomes a license requirement
There is no license condition titled "cyber security". Instead, LCCP condition 2.3.1 says: "Licensees must comply with the Commission's technical standards ... and with requirements set by the Commission relating to the timing and procedures for testing." It applies to all remote operating licenses (except trading-room-only remote betting intermediaries) and to non-remote gaming machine technical and gambling software licenses. The introduction to the Remote gambling and software technical standards (RTS 1.3, page last updated 20 March 2026) states: "Compliance with the RTS and testing strategy is a licence condition." The security requirements themselves are in RTS section 4 (last updated 4 November 2024).
The requirements at a glance
| Requirement | Source | Type | Key detail |
|---|---|---|---|
| Security controls | RTS section 4 | Technical standard | Based on Annex A of ISO/IEC 27001:2022 |
| Annual security audit | Testing strategy section 7 | Technical standard | Independent, suitably qualified auditor |
| First audit for new licensees | Security audit advice | Guidance referenced by the testing strategy | Within 6 months of license grant |
| Major non-conformities | Testing strategy section 7 | Technical standard | Audit sent to the Commission within 7 days of receipt |
| Security breach reporting | LCCP 15.2.1, key event 16 | License condition | Within five working days |
| Personal data breaches | UK GDPR Art. 33 | Law | To the ICO within 72 hours where feasible |
RTS section 4: security controls
RTS 4.1 says: "The Commission has based the security requirements on the relevant sections of Annex A to the ISO/IEC 27001:2022 standard." RTS 4.2 adds that "This 2022 standard replaces ISO/IEC 27001:2013." The controls apply to critical systems, including those that handle sensitive customer information, generate random numbers, store results, and provide entry and exit points and networks. Note that RTS 1.5 on the Commission's page still refers to the 2013 edition, while 4.1 and 4.2 refer to 2022; the 2022 edition is the one audits must use.
The Commission's consultation decision on moving to the 2022 edition added control 5.23, "Information security for use of cloud services", took effect on 31 October 2024, and said: "All security audits conducted after 1 November 2024 must be conducted against the controls listed in the updated RTS".
The annual security audit
Section 7 of the testing strategy says "an annual security audit must be carried out ... to assess compliance against the security requirements of the RTS." The auditor must be independent and suitably qualified to test compliance with ISO/IEC 27001:2022; the Commission does not approve audit firms. Audits against other standards, such as PCI DSS, may meet some of the requirements.
The Commission's security audit advice (last updated 3 March 2026) says:
- new licensees "must complete and provide their first security audit within 6 months of the granted licence";
- "Subsequent audits must be completed annually by the set due date and retained on file";
- "The scope of the audit must cover all of the RTS security elements", naming BS ISO/IEC 27001:2022 as the standard used;
- certifications that "may demonstrate suitability" include ISO 27001 Lead Auditor, CISA, CISM and CISSP.
It applies to remote general betting (except telephone-only and trading rooms), remote betting hosts, remote pool betting, remote betting intermediaries, remote bingo and casino and their game hosts, and remote external lottery managers, and society lotteries with sales over £250,000 a year.
Major non-conformities
The testing strategy says that where major non-conformities are found, "the licensee must submit a copy of the security audit ... to the Commission within 7 days of its receipt", and that on request licensees must provide the full audit within 7 days. The audit advice puts it more strongly: the Commission "must be informed without any delay". Treat the stricter reading as the safe one.
Reporting security breaches
Under LCCP 15.2.1, key event 16 is "Any security breach to the licensee's environment that adversely affects the confidentiality of customer data; or prevents the licensee's customers, staff, or legitimate users from accessing their accounts for longer than 12 hours." Key events must be reported "as soon as reasonably practicable and in any event within five working days" of becoming aware. The Commission's guidance notes its interest is wider than the ICO's, covering account unavailability and loss or corruption of critical gambling records, and that minor incidents need not always be reported, though the decision should be recorded. The guidance mentions both 12 and 24 hours for account unavailability; the condition itself says 12.
Personal data breaches are reported separately to the ICO under UK GDPR. See our breach notification comparison.
Questions about UK gambling security requirements
Do UK online gambling operators need ISO 27001 certification?
Not certification as such. They must meet the RTS security requirements, which are based on Annex A of ISO/IEC 27001:2022, and pass an annual independent security audit against them.
How quickly must a UK gambling operator report a security breach?
To the Gambling Commission, as soon as reasonably practicable and within five working days under LCCP 15.2.1. If personal data is involved and a risk is likely, also to the ICO, where feasible within 72 hours.
Sources
- Gambling Commission: LCCP 2.3.1 and 15.2.1; RTS section 4; testing strategy section 7; security audit advice (3 March 2026); notification of information security breaches (1 March 2022); Proposal 7 consultation decision
- All sources checked 24 October 2026.