How to ask a betting company for a copy of your personal data

Kenyan data subjects have a right to access their personal data held by a data controller, as the ODPC describes it. Send the operator a dated written request that names the data you want, keep proof of sending, and complain to the ODPC if the reply is missing or incomplete.

By WebTech Kenya Editorial (prepared with AI tools under our editorial policy) · Last updated 2026-10-19

The right behind the request

The Office of the Data Protection Commissioner (ODPC) lists the right of access among the rights of a data subject: the right to access personal data that a data controller or data processor holds about you. A betting account holder is the data subject, and the licensed operator is normally the controller. The terms are explained in the guide to personal data terms for gambling accounts.

The gambling rules point the same way. An online operator's approved gambling control system must include data protection measures under the Data Protection Act (Gambling Control Act s.68(2)(h)), and the conduct regulations require data collection and processing to comply with that Act (r.96(1)).

What an operator is likely to hold

Before you write, think about what exists. The conduct regulations require a licensee to keep records, and the list includes customer information (r.92(1)(j)). A licensee must also keep accurate records of participants and make them available to the Authority on request (r.96(6)). The table gives a practical checklist of data categories to name in your request.

Steps to make the request

1. Find the privacy statement and the data contact in the operator's terms or in your logged-in account. Use only that route.
2. Write one message. Say it is an access request under the Data Protection Act, give your full name, registered phone number and username, and list the categories from the table.
3. Ask for the copy in a format you can open, such as a PDF or spreadsheet, and ask what the operator does with the data and who received it.
4. Send it by email or the in-app form, keep a copy, and note the date and any reference number.
5. Diarise a follow-up. The sources read for this guide give no statutory reply period, so use any period in the operator's own terms.

Illustrative example: you send the request on the 2nd of the month. The operator's terms promise a reply "within a reasonable time" but give no figure. You note the 2nd, send a reminder on the 16th, which is 16 - 2 = 14 days later, and quote both dates in any later complaint.

Keep the request separate from other asks

An access request is not a request to close the account, to stop marketing or to delete data. Those are different requests, covered in the guides on deleting an account and personal data and stopping marketing SMS. Mixing them gives the operator an easy reason to answer only the simplest part. If you want to see the data first and decide later, send the access request alone.

Proving who you are, safely

An operator may want to confirm that you are the account holder before it releases personal data, which is a reasonable safeguard. Offer details it already holds, and ask it to explain in writing why any new document is needed. A message that arrives by SMS asking you to click a link or read out a code to "release your data" is not the operator's data route, and no legitimate request needs your PIN or mobile-money password.

Reading the reply

Compare what you receive with the table above. Check that the identity details are correct, that phone numbers are yours and that the payment history matches your own statements. If categories are missing, say which ones in a short reply and ask whether the operator holds them. If it says it holds no data in a category, ask it to confirm that in writing.

The operator may withhold or limit some material, for example records tied to anti-money laundering checks. The conduct regulations make identity verification of punters mandatory under the Proceeds of Crime and Anti-Money Laundering Act (r.98(2)). Ask the operator to state what it withheld and the reason, rather than accepting silence.

If the reply is missing or incomplete

First send a written reminder quoting your original message. If that fails, the ODPC accepts complaints from data subjects, or from a person acting on their behalf with authorisation, under section 56 of the Data Protection Act. The online form is at cie.odpc.go.ke, and the page asks you to annex copies of documents that support your claim. The steps are set out in the guide to complaining to the ODPC.

The ODPC pages read for this guide state no fee, no deadline and no timeline for outcomes. For general questions, the ODPC FAQ page lists [email protected] and +254 207 801 800. A dispute about a balance or a bet is a gambling matter: the Gambling Regulatory Authority toll-free line is 0800-723-770.

Keep the record

Store the request, the reminder, every reply and the copy you receive in one folder, named by date. The copy itself contains identity details, so keep it somewhere private and do not forward it. Gambling is addictive: play responsibly, and only if you are 18 or over. Support and self-exclusion details are on the responsible gambling page.