Subject Access Request to Sky Bet

Sky Bet is operated by SBG Sports Limited, part of Flutter Entertainment plc. It is not connected to Sky television, broadband or mobile beyond a trademark licence — Sky Betting & Gaming's own footer says "The Sky trademarks are owned by Sky Limited and are used under licence". If your request is about a Sky TV, broadband or mobile account, use the Sky page instead. SBG asks you to email your request to subjectrights.sbg@skybet.com. It offers an optional form to download, and says the form "is not mandatory however please ensure that the customer information required in the form is included with requests made in other formats, as well as a copy of ID". The Leeds address above is the address SBG invites customers to write to in its general terms; it is not named as a subject access route, so email is the route it asks for. Sky Bet says a request costs nothing, and adds that "betting and transaction history can be accessed from within your online account and does not require you to submit a Subject Access Request". If your account is open and that is all you want, look there first. Note the timings differ between SBG's own documents: its web pages say a month, and its downloadable form says 30 days running from the date it receives the completed form and suitable identification. One request covers Sky Bet only. Sky Vegas, Sky Casino, Sky Bingo, Sky Poker and Sky Bet Games are a different controller — Bonne Terre Gaming Limited — and Sky Games, Sky Sports Super6, ITV7, Timeform and Sporting Life are a third, Hestview Limited. The same mailbox and the same form are published for all of them, so say which brands and which account you mean. A subject access request gathers evidence; it is not a complaint. If you are disputing how Sky Bet handled your account, its terms say to complain to the Customer Care Team first, then escalate to its Complaints team, and then, for customers in the United Kingdom and Isle of Man, to the Independent Betting Adjudication Service, which SBG has appointed for alternative dispute resolution and which is free to use. IBAS is at Independent Betting Adjudication, PO Box 62639, London, EC3P 3AS. SBG appoints eCOGRA instead for customers outside the UK and Isle of Man. A complaint about how your data was handled goes to the ICO rather than to either. If your request is about affordability, SBG says the check itself is run elsewhere: "we may perform an affordability check, to ensure you have no markers of financial vulnerability when you use our Services. This assessment is performed on our behalf by a trusted third-party, TransUnion". It also names Bud, an Open Banking provider, for income verification. Ask SBG for what it holds and what it did with it, and expect the underlying check to sit with those companies. GAMSTOP is a separate organisation with its own records, run by The National Online Self Exclusion Scheme Limited, and its data protection contact is dataprotection@gamstop.co.uk, so a GAMSTOP registration needs its own request there. SBG says it checks the GAMSTOP database "Upon registration, login and at regular intervals", and that a permanent self-exclusion means "your information will be retained indefinitely, in order to prevent you from accessing the Services". If gambling is causing you harm, SBG points to GamCare, which "operate the National Gambling Helpline and offer confidential information, advice and support for anyone harmed by gambling in Great Britain", on Freephone 0808 8020 133, open 24 hours every day. dp@flutteruki.com is SBG's Data Protection Officer address, and it is the one on its ICO register entry. Its own words scope it to concerns — "If you have any concerns about how SBG handles your personal data" — and it sends you to the rights section to make a request, so use the subject rights mailbox above for the request itself.

Made under UK GDPR Article 15

Licensed operators must monitor customer activity to identify harm or potential harm from the point an account is opened, and the files they build doing it hold far more than your betting history: affordability and source of funds checks, responsible gambling interaction notes, internal risk flags, VIP or high-value customer designations, and the marketing you were sent and when.

These records are most often requested by people building a complaint about how an operator handled their account. The operator's own interaction notes and affordability checks are usually the substance of that complaint, and they are personal data, so they fall within a subject access request.

Self-exclusion is handled by more than one organisation. The national online self-exclusion scheme is run by The National Online Self Exclusion Scheme Limited, trading as GAMSTOP, which publishes its own data protection contact — so records of a GAMSTOP registration need a separate request to GAMSTOP rather than to the operator.

• Complete account and transaction history
• Affordability, source of funds and Know Your Customer checks
• Responsible gambling interaction notes and internal flags
• Marketing and bonus offers sent to you, with dates
• Self-exclusion requests and how they were actioned

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.