Can a betting company share your data with third parties?

Not freely. A licensed operator must follow the Data Protection Act, may collect and process data only for purposes directly related to running the gambling operation, and may not use it for marketing without your prior consent (r.96). Sharing with the regulator, the law or a court is a different matter.

By WebTech Kenya Editorial (prepared with AI tools under our editorial policy) · Last updated 2026-10-23

The short answer

A licensed operator in Kenya is not free to pass your data to anyone it likes. The conduct regulations require that data collection and processing during gambling operations comply with the Data Protection Act, and they limit the purposes (r.96(1) and (2)). The same regulations also require some sharing, mainly with the regulator.

This guide separates three cases: sharing the law requires, uses that need your consent, and uses the rules do not allow. It reads the gambling Act and regulations only. The Data Protection Act itself was not available to read for this guide, so its detailed provisions are not restated; the terms are explained in personal data terms for gambling accounts.

Sharing the gambling law requires

Some disclosure is built into the licence. Before starting, a licensee notifies the Authority that it is integrated with the applicable tax system and with the Authority's central monitoring system, and it must have obtained a data protection certificate from the Office of the Data Commissioner (r.3(3)). The Act also lists collaboration with the Kenya Revenue Authority on a tax compliance monitoring system among the Authority's functions (s.10(o)).

Records are the second channel. A licensee keeps records of financial transactions, player accounts and complaints (r.91(1)), and the list of records it keeps includes customer information and a data protection report (r.92(1)(j) and (l)). The books must be available for inspection by the Authority's inspectors (r.92(2)). For how those records look in practice, see how operators record deposits and withdrawals.

Third, operators must report fraud and suspicious activity to the Authority within twenty-four hours (rr.91(2) and 93(1)), and must verify the identity of all punters under the Proceeds of Crime and Anti-Money Laundering Act (r.98(2)).

What each situation looks like

Marketing and unrelated uses

Two sentences of r.96 do most of the work. Data may be collected and processed only for purposes directly related to the administration of the gambling operation, and it must not be used for any form of marketing without the participant's prior consent. If an operator hands your phone number to another company for its own promotions, it is hard to see how either rule is met.

The approval process points the same way. The terms and conditions an operator submits to the Authority must include data collection and privacy statements as required by the data protection laws (r.4(2)(u)). The Act adds that an online operator's approved gambling control system must provide for data protection measures under the Data Protection Act (s.68(2)(h)). If marketing messages already reach you, the steps are in how to stop betting marketing SMS.

Winners and confidentiality

A licensee must protect the confidentiality of all winners. It may disclose a winner's identity or personal information only with the winner's written consent, as required under the Act or another written law, or under a court order (r.90). Advertising and publicity must not expose winners without their consent (r.90(3)). Note that r.90 sits in the part of the regulations on prize competitions, so check how far it reaches before relying on it for a different product.

What to do if you think your data was shared

1. Ask the operator in writing who received your data and why, quoting r.96. The guide on requesting a copy of your data sets out the request.
2. Object to marketing use in writing and keep the date.
3. If the reply is missing or unsatisfactory, follow how to complain to the ODPC.

Illustrative example: you refuse marketing on the 2nd. On the 6th a company you have never dealt with texts you about a betting offer. You send the operator a written question on the 7th, attach screenshots with the sender and time, and ask which parties received your number. The operator's answer, or its silence, becomes the evidence for the ODPC.

Self-exclusion and shared data

One kind of sharing is set out openly on a form. The self-exclusion application asks you to consent to the Authority and licensed operators collecting, processing and sharing your personal data solely to enforce the exclusion, and to your inclusion in the national register of excluded persons. The purpose is narrow, and the consent is yours to give or withhold.

Limits of this guide

Rules on transfers abroad, on processors working for an operator and on penalties sit in the Data Protection Act, which this guide does not restate. The register of licensed operators describes the 2025/26 trading period, so check the live GRA register before naming a company. The GRA toll-free line is 0800-723-770. Gambling is addictive: play responsibly, and only if you are 18 or over. The responsible gambling page lists help.