How long can a betting company keep your personal data in Kenya?
No fixed number of years applies to every betting record. The Data Protection Act says an operator may keep personal data only as long as reasonably necessary for its purpose, unless the law requires or you consent to longer. The gambling regulations require some records but, in the texts read here, name no period for customer data.
The short answer: a test, not a number
Kenyan law does not give one retention period for betting data. The Data Protection Act, 2019 says a data controller must retain personal data "only as long as may be reasonably necessary to satisfy the purpose for which it is processed", unless the retention is required or authorised by law, reasonably necessary for a lawful purpose, authorised or consented to by the data subject, or for historical, statistical, journalistic, literary, art or research purposes (s.39(1)). A licensed operator is a data controller for the account you hold with it, and the terms used here are explained in the guide to personal data terms for gambling accounts.
When the purpose ends, the controller must delete, erase, anonymise or pseudonymise data that is not necessary to keep, in the manner specified at the expiry of the retention period (s.39(2)). The Act also lists, among its principles, that data be kept in a form identifying you for no longer than is necessary for the purposes it was collected for (s.25(g)).
What the gambling rules add
The gambling rules sit on top of the Data Protection Act. They do two things: they require some records to be kept, and they limit what an operator may do with data. They do not, in the texts read for this guide, state a number of years for customer data.
| Provision | What it says | Effect on retention |
|---|---|---|
| Gambling Control Act s.68(2)(h) | An operator's approved gambling control system must provide data protection measures under the Data Protection Act. | Operators are expected to apply the Act's retention test. |
| Conduct Regulations r.92(1)(j), (l) | A licensee must keep and maintain records including customer information and a data protection report. | Customer information is a required record; no period is given. |
| Conduct Regulations r.96(1)-(3) | Data must be handled under the Data Protection Act, collected only for purposes directly related to administering the gambling operation, and not used for marketing without prior consent. | Limits purpose, so limits how long a purpose can justify keeping data. |
| Conduct Regulations r.98(2) | Identity of all punters must be verified under the Proceeds of Crime and Anti-Money Laundering Act. | Verification records can legitimately outlast the account. |
| Gambling Control Act s.95 | Failing to keep required books or records, or keeping false ones, is an offence. | Explains why operators keep required records. |
| Advertising Regulations r.13(3) | A licensee must keep copies of advertisements and approval records for at least three years. | The only fixed minimum found, and it concerns advertisements, not your data. |
The Advertising Regulations figure is easy to misread. It applies to the operator's own advertisements and approval records, so it is not a retention period for your account data.
Records the operator may keep after you leave
Because customer information and verification records are required records, expect an operator to keep at least some of your data after the account is closed. Section 30(1)(b)(ii) of the Data Protection Act allows processing that is necessary for compliance with a legal obligation. The sections read here do not say how long. The honest position is that the period depends on which law the record serves.
That is why a request to delete an account and personal data should ask the operator to list what it keeps, for what purpose and for how long. Section 29 of the Act requires a controller, before collecting data, to inform you of the purpose of collection, whether collection is voluntary or mandatory, and your rights, so the privacy statement is the first place to look for a stated period.
What you can ask for, and when
| Situation | Your right | Source |
|---|---|---|
| Data is inaccurate, out-dated, incomplete or misleading | Ask for rectification without undue delay | DPA s.40(1)(a) |
| Operator is no longer authorised to retain the data, or it is irrelevant, excessive or unlawfully obtained | Ask for erasure or destruction without undue delay | DPA s.40(1)(b) |
| Data is needed as evidence | Processing is restricted instead of erased, and you must be informed within a reasonable time | DPA s.40(3) |
| You contest accuracy, or the data is no longer needed for its purpose | Ask for restriction of processing (an operator may still hold data for a legal claim) | DPA s.34(1) |
| You object to processing | Operator must stop unless it shows compelling legitimate interest or a legal-claim need | DPA s.36 |
| Data was shared with a third party | Operator must take reasonable steps to tell that party of your request | DPA s.40(2) |
The Act sets no reply deadline for erasure in the sections read here; "without undue delay" is its wording. To see what an operator holds before you ask for erasure, follow the steps to request a copy of your data.
Time limits that do exist
Several gambling-law periods are often mixed up with data retention. They concern money, marketing or licence status.
| Period | What it governs | Source |
|---|---|---|
| Three months with no transaction | Operator must remit the account balance to the player | Gambling Control Act s.77(1) |
| Five years, whereabouts unknown | Balance presumed abandoned and remitted to the Unclaimed Financial Assets Authority | Gambling Control Act s.77(2) |
| Two days after a completed self-exclusion notification | Operator must remove your details from its marketing databases | Gambling Control Act s.115(4)(c) |
| Ninety days' notice | Winding up, including how personal data will be disposed of | Conduct Regulations r.99(1)-(2) |
None of these says "delete your data after this long". The rules on inactive account balances explain the money side.
When the operator stops trading or loses its licence
A licensee that wants to wind up must give the Authority at least ninety days' written notice, with the method for refunding deposits, settling winnings and disposing of personal data (r.99). The Authority publishes the intended winding up on its website (r.99(3)). If a licence is revoked, the licensee must take measures to safeguard player deposits and personal data, and where the Authority takes over the business it hands over the entire database and then erases all data in its own database as the Authority specifies (Licensing Regulations r.26(5)-(6)).
Illustrative example
Illustrative example: a player stops using an account that holds KES 350. Three months after the last recorded transaction, section 77(1) requires the operator to remit that KES 350 to the player. The account data is a separate question. The operator may keep customer information and identity-verification records it is required to hold, and must justify any other retention by a purpose under section 39. If the player asks for erasure, the operator can erase what it is no longer authorised to keep and tell the player what it retained.
If the answer is vague or the operator refuses
Ask in writing for the retention period for each category of data and the legal basis for keeping it. If the reply is missing or unsatisfactory, a data subject can report the matter to the ODPC. Its page says complaints are filed online, supporting documents should be annexed, and written authorisation is needed to complain for someone else. Gambling is addictive: play responsibly, only if you are 18 or over, and see the responsible gambling page for the GRA helpline and the self-exclusion process.
This guide explains public rules and is not legal advice. Retention rules can be changed by amendment or by guidance from the Data Commissioner, so check the current texts.
Questions and answers
Is there a fixed number of years a betting company must keep my data?
Not in the texts read for this guide. The Data Protection Act sets a test (as long as reasonably necessary for the purpose, section 39(1)) rather than a number. The conduct regulations list customer information among records to be kept (regulation 92(1)(j)) without stating a period.
Is my data deleted three months after I stop betting?
Neither is a data retention rule. Section 77(1) of the Gambling Control Act is about money: if no transaction is recorded on a player's account for three months, the licensee must remit the balance to the player. It says nothing about deleting the data.
Can I make an operator delete everything?
You can ask for erasure of data it is no longer authorised to retain, or that is irrelevant, excessive or unlawfully obtained (Data Protection Act s.40(1)(b)). Where data is needed as evidence, the operator may restrict its processing instead of erasing it (s.40(3)). Data it must keep under law can stay.
What happens to my data if the operator closes or loses its licence?
A licensee winding up must tell the Authority, at least ninety days ahead, how it will dispose of personal data (Conduct Regulations r.99). After revocation, a licensee must safeguard personal data and, if the Authority takes over the business, hand over the database and erase its own copy as the Authority specifies (Licensing Regulations r.26(5)-(6)).
Does self-exclusion mean my data is deleted?
No. Under section 115(4)(c) of the Gambling Control Act the operator must remove your name and contact details from its marketing databases within two days of receiving the completed self-exclusion notification, and close the account. The Authority also keeps a register of self-exclusions, which is a separate record.
Where do I complain if an operator keeps data it should not?
A data subject can file a complaint with the Office of the Data Protection Commissioner through its online form, attaching supporting documents. The ODPC page cites section 56 of the Data Protection Act.
Sources
- Data Protection Act, 2019 (No. 24 of 2019), ss.25(g), 26, 29, 30, 34, 39, 40 (ODPC copy), accessed 2026-10-19
- Gambling Control Act, 2025, ss.68(2)(h), 77, 95, 115, accessed 2026-10-19
- Gambling Control (Conduct of Gambling Operations) Regulations, 2026, rr.92, 96, 98, 99, accessed 2026-10-19
- Gambling Control (Licensing) Regulations, 2026 (L.N. 111), r.26, accessed 2026-10-19
- Gambling Control (Advertising) Regulations, 2026 (L.N. 114), r.13(3), accessed 2026-10-19
- Office of the Data Protection Commissioner: file a complaint, accessed 2026-10-19