Data & Privacy

Data localisation, KYC data handling, retention and cross-border transfer.

Flags

Jurisdictions

Read order

Theme-major

Cross-jurisdiction posture cluster

51 flags across 40 jurisdictions. Posture mass: Rules 26 · Risks 10 · Reality 15.

Michigan — State 3 ⚠🇲🇲 Myanmar 1 ⚠🇺🇦 Ukraine 1 ⚠🇪🇸 Spain 3 🇱🇰 Sri Lanka 3 🇵🇹 Portugal 3

Worked examples

Each links back to the full jurisdiction page — the theme view is a projection of those country ledgers.

Michigan — State →

Accepting out-of-state wagers

Participant must be within Michigan; geolocation is mandatory.

3 data & privacy flags on this jurisdiction · see full country page

🇲🇲 Myanmar →

Junta-linked SOE engagement

SAC entities under targeted OFAC sanctions (E.O. 14014).

1 data & privacy flags on this jurisdiction · see full country page

🇺🇦 Ukraine →

Active war / martial law

Operational continuity, territorial control and infrastructure are at risk.

1 data & privacy flags on this jurisdiction · see full country page

Rules · Risks · Reality across the cohort

Lens · which facet of each jurisdiction’s flags:

Showing all facets.

Michigan — StateCritical

Accepting out-of-state wagers

Participant must be within Michigan; geolocation is mandatory.

SRC-US-MI-002

Michigan — StateCritical

Accepting out-of-state wagers

Participant must be within Michigan; geolocation is mandatory.

SRC-US-MI-002

Michigan — StateCritical

Accepting out-of-state wagers

Participant must be within Michigan; geolocation is mandatory.

SRC-US-MI-002

🇲🇲 MyanmarCritical

Junta-linked SOE engagement

SAC entities under targeted OFAC sanctions (E.O. 14014).

SRC-MM-005

🇺🇦 UkraineCritical

Active war / martial law

Operational continuity, territorial control and infrastructure are at risk.

SRC-UA-009

🇦🇷 ArgentinaHigh

Mishandling biometric/sensitive data

Ley 25.326 classifies biometric data as sensitive and restricts international transfers.

SRC-AR-001

Maryland — StateHigh

Tax-rate change conflicts with baseline spec

Downstream analyses using 15% mobile figure will be wrong.

SRC-US-MD-003

🇧🇬 BulgariaMedium

Non-GDPR-compliant processing

GDPR + Bulgarian DPA apply.

SRC-BG-002

Connecticut — StateMedium

GPS geo-gating required

Out-of-state wagers must be blocked at the device level.

SRC-US-CT-005

🇪🇪 EstoniaMedium

GDPR / AKI player-data enforcement

Player data processing must meet GDPR and Estonian DPA.

SRC-EE-013

🇬🇭 GhanaMedium

DPC registration and cross-border transfer approval

Data-flow constraints under Act 843.

SRC-GH-005

🇮🇩 IndonesiaMedium

NIK cross-checking of accounts

Players identifiable via national ID linkage.

SRC-ID-008

🇵🇰 Islamic Republic of PakistanMedium

Holding PK player data for gambling

Data tied to unlawful activity compounds criminal exposure.

SRC-PK-002

🇲🇿 MozambiqueMedium

No specific data-protection law

Player-data handling rests on fragmented provisions.

SRC-MZ-001

🇳🇬 NigeriaMedium

No DPO/NDPA registration

NDPA 2023 obligations and NDPC investigations

SRC-NG-002

🇵🇦 PanamaMedium

Ignoring Ley 81/2019 obligations

APDATOS supervises data protection; non-compliance risks sanction.

SRC-PA-003

🇵🇦 PanamaMedium

Incomplete transaction history

Complete account history must be available to the government on request.

SRC-PA-012

🇵🇪 PeruMedium

No real-time MINCETUR data access

Daily automatic data transmission to MINCETUR Data Centre is required.

SRC-PE-008

Rhode Island — StateMedium

Mandatory in-state geolocation

No interstate liquidity; breach risk under Wire Act.

SRC-US-RI-003

🇷🇼 RwandaMedium

Western scrutiny over DR Congo/M23

Aid-threat and reputational pressure raise banking and macro risk for inbound investors.

SRC-RW-008

🇸🇦 Saudi ArabiaMedium

Collecting Saudi player data for gambling

PDPL and cybercrime exposure compound gambling-prohibition risk.

SRC-SA-001

🇷🇸 SerbiaMedium

Improper personal data handling

Data protection embedded in licensing.

SRC-RS-008

🇻🇳 Socialist Republic of VietnamMedium

Assuming no localisation/operation requirements

Decree 147/2024 requires cross-border providers to establish domestic operations.

SRC-VN-007

🇪🇸 SpainMedium

Serving players outside Spain on .es licence assumptions

Operators must geo-restrict and comply with foreign rules.

SRC-ES-006

🇪🇸 SpainMedium

Serving players outside Spain on .es licence assumptions

Operators must geo-restrict and comply with foreign rules.

SRC-ES-006

🇪🇸 SpainMedium

Serving players outside Spain on .es licence assumptions

Operators must geo-restrict and comply with foreign rules.

SRC-ES-006

🇱🇰 Sri LankaMedium

Non-compliance with PDPA No. 9 of 2022

Software compliance with data protection law required.

SRC-LK-006

🇱🇰 Sri LankaMedium

Non-compliance with PDPA No. 9 of 2022

Software compliance with data protection law required.

SRC-LK-006

🇱🇰 Sri LankaMedium

Non-compliance with PDPA No. 9 of 2022

Software compliance with data protection law required.

SRC-LK-006

🇦🇪 United Arab Emirates — federal jurisdiction (nascent GCGRA framework)Medium

Operating in 'sensitive geographic areas'

GCGRA designates sensitive zones where access is blocked.

SRC-AE-004

Virginia — StateMedium

Failing bettor data protection

Statutory confidentiality duty.

SRC-US-VA-001

🇩🇿 AlgeriaLow

Law 18-05 hosting/.com.dz requirements

Domestic hosting / domain requirements add compliance friction.

SRC-DZ-007

British Columbia — Canada (province)Low

Ignoring FIPPA/PIPEDA obligations

Data handling is governed by FIPPA/PIPEDA.

SRC-CA-BC-001

🇨🇲 CameroonLow

No dedicated gambling data-protection rules

Reliance on sectoral cyber/telecom laws creates compliance ambiguity.

SRC-CM-001

🇨🇷 Costa RicaLow

Overreliance on PRODHAB protections

Limited enforcement; not a gambling-specific framework.

SRC-CR-002

Delaware — StateLow

Data localisation status not yet assessed

Published specs do not confirm localisation requirements.

SRC-US-DE-003

🇩🇴 Dominican RepublicLow

Weak data-protection regime (Ley 172-13)

Player-data governance rests on an underdeveloped law.

SRC-DO-008

🇪🇬 EgyptLow

Operating telecom-adjacent service

Cybercrime Law Art. 2 mandates 180-day user-data retention.

SRC-EG-002

🇰🇪 KenyaLow

KDPA 2019 cross-border transfer rules

Data transfers outside Kenya require adequate protection.

SRC-KE-010

🇲🇹 MaltaLow

Data retention duties S.L. 583.12

Compliance overhead for record retention.

SRC-MT-002

Maryland — StateLow

Active licensee count dynamic

Confirm count against MLGCA database before commercial reliance.

SRC-US-MD-004

🇵🇹 PortugalLow

GDPR/CNPD enforcement

Player-data handling adds technical compliance complexity.

SRC-PT-007

🇵🇹 PortugalLow

GDPR/CNPD enforcement

Player-data handling adds technical compliance complexity.

SRC-PT-007

🇵🇹 PortugalLow

GDPR/CNPD enforcement

Player-data handling adds technical compliance complexity.

SRC-PT-007

Quebec — Canada (province)Low

Law 25 data protection regime

Any future entrant must comply with stringent QC privacy law.

SRC-CA-QC-001

Quebec — Canada (province)Low

Geolocation confinement to QC residents

Technical geo-gating required for any compliant offering.

SRC-CA-QC-008

🇨🇭 SwitzerlandLow

Hosting assumptions

Domestic hosting expectation; data-localisation specifics not codified.

SRC-CH-009

🇹🇿 TanzaniaLow

Unpublished fee point-figures

Budgeting uncertainty.

SRC-TZ-002

🇹🇳 TunisiaLow

Cross-border data transfer authorisation (Law 2004-63)

Adds compliance overhead for any data processing

SRC-TN-002

🇺🇬 UgandaLow

Data Protection and Privacy Act 2019 obligations

Compliance overhead for player data handling.

SRC-UG-002

🇺🇾 UruguayLow

Mandatory database registration / breach notification

URCDP obligations apply to entities operating locally.

SRC-UY-006