Personal data terms every player account holder should know

When you register with an operator, you are a data subject and the operator is a data controller under the Data Protection Act. You have the right to be informed, to access your data, to object, and to have false or misleading data corrected or deleted (s.26). Complaints go to the Data Commissioner (s.56).

By WebTech Kenya Editorial (prepared with AI tools under our editorial policy) · Last updated 2026-10-04

The terms

Personal data: "any information relating to an identified or identifiable natural person" (s.2). Your name, ID number, phone number, transaction history and the documents collected during identity and proof-of-age checks all qualify.

Data subject: the identified or identifiable person the data is about. In a player account, that is you.

Data controller: the person or body that "determines the purpose and means of processing of personal data". For a player account, the licensed operator.

Data processor: a person or body that processes personal data on behalf of the controller, such as an outside service the operator uses.

Consent: an "express, unequivocal, free, specific and informed indication" of your wishes, by a statement or a clear affirmative action. Section 37 requires express consent before personal data is used for commercial purposes, and r.96(3) of the gambling operations regulations bars marketing use without prior consent.

Personal data breach: a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Section 43 sets a seventy-two hour deadline for notifying the Data Commissioner where there is a real risk of harm. Steps for the account holder are in the guide on securing an account against takeover.

Your rights in one list

• To be informed of the use to which your data is put (s.26(a)).
• To access your data held by the controller or processor (s.26(b)).
• To object to processing of all or part of it (s.26(c)).
• To correction, and to deletion, of false or misleading data (s.26(d) and (e)).
• To ask for rectification or erasure without undue delay (s.40).
• To compensation for damage caused by a contravention of the Act (s.65).

Complaints

A data subject may lodge a complaint with the Data Commissioner, orally or in writing, and the Act says it shall be investigated and concluded within ninety days (s.56). The Office of the Data Protection Commissioner directs complainants to its online complaint portal and asks for supporting documents to be attached. Under s.63 the maximum administrative penalty is five million shillings or, for an undertaking, one per cent of annual turnover, whichever is lower.