Subject Access Request to GAMSTOP

GAMSTOP is the trading name of The National Online Self Exclusion Scheme Limited, a not-for-profit company registered in England and Wales with company number 10504973, which renamed its service Gamstop Online in November 2025. Since 31 March 2020 every gambling operator licensed in Great Britain has had to be part of the scheme as a condition of its Gambling Commission licence. GAMSTOP holds your registration record in its own right — its privacy policy sets out its own lawful bases and retention periods and a contract with you under its Terms of Use, and the ICO register lists it as a data controller under ZA247738 — so an operator cannot give you your GAMSTOP record, and GAMSTOP cannot give you an operator's. The registration data GAMSTOP asks for is your title, first and last name, current address and postcode and any postcodes you have lived at previously, date of birth, any email addresses you use or have used, and any mobile numbers you use or have used. Alongside it GAMSTOP records your self-excluded status and the verification of it, your account details, correspondence and complaints, the emails it sent you and the IP address of any device that opened them, call recordings kept for up to three months, and identity-verification material. It says it may also hold information about someone incorrectly identified as self-excluded. A subject access request cannot end or shorten a self-exclusion, and neither can GetMySAR. GAMSTOP says it cannot remove anyone's exclusion early, and that it will not delete your personal data during your chosen minimum period. Asking what GAMSTOP holds and asking GAMSTOP to lift a block are two separate things: the first is what this page is about, and the second follows the rules below and nothing else. The minimum period you choose at registration is six months, one year, five years, or five years with auto-renewal. GAMSTOP will not remove the exclusion automatically when that period ends and will not contact you to say it has ended: it stays in place for a further seven years unless you sign in, confirm it has expired and use Request Removal, which is completed by online chat or by phone on 0800 138 6518, 10am to 8pm every day. A cooling-off period of at least 24 hours then follows, during which you can cancel the removal in your account. GAMSTOP asks people not to contact it before the minimum period has expired. If you chose auto-renewal, a new five-year period begins automatically and can only be turned off in the last six months of the current one. GAMSTOP publishes no subject access page and no request form. Its privacy policy lists the right to access your information, gives one data protection address — the email above, for its Data Protection Officer — and says its Contact Centre will take any questions about your personal information. But its Contact us page offers that Contact Centre for help with registering and sends you to your own account to change your details or extend a block, so it is not published as a way of making a request; its other channels are helpdesk@gamstop.co.uk, webchat, the freephone number above and a contact form in its help centre. The Harrogate address above is the registered office GAMSTOP publishes in its Terms of Use and in the footer of every page, and the address it gives in the Data Protection Officer role on its ICO registration; GAMSTOP does not name post as a request route. It publishes no response time for a request and no list of identity documents for one. Some of what people want is already free in your GAMSTOP account, which shows your exclusion start date and minimum period and lets you keep your registered details up to date. GAMSTOP says the service is entirely free for consumers and always will be, that it will never ask for your bank or payment card details, and that anyone claiming to be from Gamstop who does should be reported to Trading Standards through the Citizens Advice service. It publishes nothing about third parties who offer to remove or shorten a self-exclusion; the only two ways an exclusion ends are the ones above. Records held by other organisations need their own requests. GAMSTOP uses TransUnion for its identity questions and says TransUnion holds that information, so ask TransUnion for it. An operator's own account, betting and self-exclusion records stay with the operator — see Sky Bet and bet365 — and an operator may keep its own block in place after a GAMSTOP exclusion has gone. Gamstop Betting Shops is a separate company in the same group, and GAMSTOP says it does not use GAMSTOP information to register you with the group's other schemes and that you must register with them separately. GAMSTOP publishes nothing about requests concerning someone who has died, and data protection rights end at death, so that is not a subject access request. If gambling is causing you harm, GAMSTOP points to the National Gambling Helpline on freephone 0808 8020 133, open 24 hours a day, with live chat on the GamCare website.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.