--- title: "Data & Privacy across all jurisdictions — Gambling Regulatory Intelligence · Advennt" canonical: https://advennt.io/themes/data_privacy/ source_html: /themes/data_privacy/index.html description: "Advennt regulatory intelligence — Data & Privacy rolled up across 35 jurisdictions. Each claim traces to its country page." generated_at: 2026-10-26T19:22:25Z content_sha256: 3c36744cdc69bb4bf873e0ef94c366e32a50bbe4979da590d6d46d3a07317948 generator: "fe-fleet/md-twin@1.0" --- # Data & Privacy across all jurisdictions — Gambling Regulatory Intelligence · Advennt ` landed in the SECOND track while the first stayed empty, and the whole index rendered inside 1fr of a 1140px box with a dead 210px gutter. That is the "one column" the operator saw. Fixed with a modifier on the index only, so detail pages keep 210px 1fr. */ .layout--single{grid-template-columns:minmax(0,1fr);max-width:var(--chrome-maxw,1600px)} /* Prose still needs a readable measure -- full width is for the CARD GRID, not for a 1600px line of text. */ .layout--single .lead{max-width:84ch} .tx-index{display:grid;grid-template-columns:repeat(auto-fit,minmax(260px,1fr));gap:14px;margin-top:16px} .tx-card{border:1px solid var(--line,#e5e7eb);border-radius:12px;padding:18px;text-decoration:none;color:var(--ink-1,#111);background:var(--surface,#fff)} .tx-card:hover{border-color:var(--accent,#b45309)} .tx-card h3{margin:0 0 6px} .tx-card .tx-def{font-size:13px;color:var(--ink-2,#374151)} .tx-card .tx-stat{font-size:12px;color:var(--accent,#b45309);margin-top:10px;font-weight:600} /* T3 typography rebase (session arti-17fcf3a5) — theme-scoped, cascades last. The shared engine CSS hardcodes -apple-system on body and declares --ui/--read without ever loading the faces, so Satoshi silently fell back. fonts.css + typography.css are now linked in (fonts.css supplies the self-hosted @font-face rules); this rule makes the page consume the token it already declares. Deliberately NOT changed in the engine renderer: build_jurisdiction_page_v3.py also builds the ~105 JID pages, so a body-font change there is a full-reflow decision, not a theme fix. */ body{font-family:var(--ui)} [Skip to content](#app) # Data & Privacy Data localisation, KYC data handling, retention and cross-border transfer. Flags 38 Jurisdictions 35 Read order Theme-major 5 further jurisdictions with flags in this theme are in expert review and not shown until published. ## Cross-jurisdiction posture cluster 38 flags across 35 jurisdictions. Posture mass: Rules 18 · Risks 7 · Reality 13. [🇲🇲 Myanmar 1 ⚠](/jurisdictions/myanmar/)[Michigan — State 1 ⚠](/jurisdictions/michigan/)[Quebec — Canada (province) 2](/jurisdictions/quebec/)[🇵🇦 Panama 2](/jurisdictions/panama/)[Maryland — State 2](/jurisdictions/maryland/)[🇦🇪 United Arab Emirates — federal jurisdiction (GCGRA framework) 1](/jurisdictions/united-arab-emirates/) ## Worked examples Each links back to the full jurisdiction page — the theme view is a projection of those country ledgers. [🇲🇲 Myanmar →](/jurisdictions/myanmar/) Junta-linked SOE engagement SAC entities under targeted OFAC sanctions (E.O. 14014). 1 data & privacy flags on this jurisdiction · see full country page [Michigan — State →](/jurisdictions/michigan/) Accepting out-of-state wagers Participant must be within Michigan; geolocation is mandatory. 1 data & privacy flags on this jurisdiction · see full country page [Quebec — Canada (province) →](/jurisdictions/quebec/) Law 25 data protection regime Any future entrant must comply with stringent QC privacy law. 2 data & privacy flags on this jurisdiction · see full country page ## Rules · Risks · Reality across the cohort Lens · which facet of each jurisdiction’s flags: All Rules Risks Reality Showing all facets. [Michigan — State](/jurisdictions/michigan/) Critical Accepting out-of-state wagers Participant must be within Michigan; geolocation is mandatory. [🇲🇲 Myanmar](/jurisdictions/myanmar/) Critical Junta-linked SOE engagement SAC entities under targeted OFAC sanctions (E.O. 14014). [🇦🇷 Argentina](/jurisdictions/argentina/) High Mishandling biometric/sensitive data Ley 25.326 classifies biometric data as sensitive and restricts international transfers. [Maryland — State](/jurisdictions/maryland/) High Tax-rate change conflicts with baseline spec Downstream analyses using 15% mobile figure will be wrong. [🇧🇬 Bulgaria](/jurisdictions/bulgaria/) Medium Non-GDPR-compliant processing GDPR + Bulgarian DPA apply. [Connecticut — State](/jurisdictions/connecticut/) Medium GPS geo-gating required Out-of-state wagers must be blocked at the device level. [🇪🇪 Estonia](/jurisdictions/estonia/) Medium GDPR / AKI player-data enforcement Player data processing must meet GDPR and Estonian DPA. [🇬🇭 Ghana](/jurisdictions/ghana/) Medium DPC registration and cross-border transfer approval Data-flow constraints under Act 843. [🇮🇩 Indonesia](/jurisdictions/indonesia/) Medium NIK cross-checking of accounts Players identifiable via national ID linkage. [🇵🇰 Islamic Republic of Pakistan](/jurisdictions/pakistan/) Medium Holding PK player data for gambling Data tied to unlawful activity compounds criminal exposure. [🇳🇬 Nigeria](/jurisdictions/nigeria/) Medium No DPO/NDPA registration NDPA 2023 obligations and NDPC investigations SRC-NG-002 [🇵🇦 Panama](/jurisdictions/panama/) Medium Ignoring Ley 81/2019 obligations APDATOS supervises data protection; non-compliance risks sanction. [🇵🇦 Panama](/jurisdictions/panama/) Medium Incomplete transaction history Complete account history must be available to the government on request. [Rhode Island — State](/jurisdictions/rhode-island/) Medium Mandatory in-state geolocation No interstate liquidity; breach risk under Wire Act. [🇷🇼 Rwanda](/jurisdictions/rwanda/) Medium Western scrutiny over DR Congo/M23 Aid-threat and reputational pressure raise banking and macro risk for inbound investors. [🇸🇦 Saudi Arabia](/jurisdictions/saudi-arabia/) Medium Collecting Saudi player data for gambling PDPL and cybercrime exposure compound gambling-prohibition risk. [🇷🇸 Serbia](/jurisdictions/serbia/) Medium Improper personal data handling Data protection embedded in licensing. [🇻🇳 Socialist Republic of Vietnam](/jurisdictions/vietnam/) Medium Assuming no localisation/operation requirements Decree 147/2024 requires cross-border providers to establish domestic operations. [🇪🇸 Spain](/jurisdictions/spain/) Medium Serving players outside Spain on .es licence assumptions Operators must geo-restrict and comply with foreign rules. [🇱🇰 Sri Lanka](/jurisdictions/sri-lanka/) Medium Non-compliance with PDPA No. 9 of 2022 Software compliance with data protection law required. [🇦🇪 United Arab Emirates — federal jurisdiction (GCGRA framework)](/jurisdictions/united-arab-emirates/) Medium Operating in 'sensitive geographic areas' GCGRA designates sensitive zones where access is blocked. [Virginia — State](/jurisdictions/virginia/) Medium Failing bettor data protection Statutory confidentiality duty. [🇩🇿 Algeria](/jurisdictions/algeria/) Low Law 18-05 hosting/.com.dz requirements Domestic hosting / domain requirements add compliance friction. [British Columbia — Canada (province)](/jurisdictions/british-columbia/) Low Ignoring FIPPA/PIPEDA obligations Data handling is governed by FIPPA/PIPEDA. [🇨🇲 Cameroon](/jurisdictions/cameroon/) Low No dedicated gambling data-protection rules Reliance on sectoral cyber/telecom laws creates compliance ambiguity. [🇨🇷 Costa Rica](/jurisdictions/costa-rica/) Low Overreliance on PRODHAB protections Limited enforcement; not a gambling-specific framework. [Delaware — State](/jurisdictions/delaware/) Low Data localisation status not yet assessed Published specs do not confirm localisation requirements. [🇩🇴 Dominican Republic](/jurisdictions/dominican-republic/) Low Weak data-protection regime (Ley 172-13) Player-data governance rests on an underdeveloped law. [🇪🇬 Egypt](/jurisdictions/egypt/) Low Operating telecom-adjacent service Cybercrime Law Art. 2 mandates 180-day user-data retention. [🇰🇪 Kenya](/jurisdictions/kenya/) Low KDPA 2019 cross-border transfer rules Data transfers outside Kenya require adequate protection. [🇲🇹 Malta](/jurisdictions/malta/) Low Data retention duties S.L. 583.12 Compliance overhead for record retention. [Maryland — State](/jurisdictions/maryland/) Low Active licensee count dynamic Confirm count against MLGCA database before commercial reliance. [Quebec — Canada (province)](/jurisdictions/quebec/) Low Law 25 data protection regime Any future entrant must comply with stringent QC privacy law. [Quebec — Canada (province)](/jurisdictions/quebec/) Low Geolocation confinement to QC residents Technical geo-gating required for any compliant offering. [🇹🇿 Tanzania](/jurisdictions/tanzania/) Low Unpublished fee point-figures Budgeting uncertainty. [🇹🇳 Tunisia](/jurisdictions/tunisia/) Low Cross-border data transfer authorisation (Law 2004-63) Adds compliance overhead for any data processing [🇺🇬 Uganda](/jurisdictions/uganda/) Low Data Protection and Privacy Act 2019 obligations Compliance overhead for player data handling. [🇺🇾 Uruguay](/jurisdictions/uruguay/) Low Mandatory database registration / breach notification URCDP obligations apply to entities operating locally.