The Isle of Man Gambling Supervision Commission (“the Commission” or “GSC”) is a data controller registered with the Isle of Man Information Commissioner.

This Privacy Notice explains how the Commission collects, uses, shares and protects personal information when carrying out its statutory functions as the Isle of Man’s gambling regulator.

We may update this Privacy Notice from time to time to reflect changes in our processing activities, legal or regulatory requirements, or our practices. Where appropriate, we may also provide additional privacy information in relation to particular processing activities.

References in this Privacy Notice to Manx gambling legislation include the legislation under which the Commission carries out its gambling regulatory functions. Further information is available on the GSC’s gambling legislation pages.

This Privacy Notice relates to the Commission's gambling regulatory functions. Information about how we process personal information in connection with our regulatory functions for medicinal cannabis is provided separately on the GSC’s privacy pages.

This privacy notice was last updated on 4 November 2026

The Commission processes personal information where necessary to carry out its statutory regulatory functions and powers.

Under section 5 of the Gambling Supervision Act 2010, the Commission must, so far as reasonably practicable, exercise its functions in a way that is compatible with its regulatory objectives. In relation to gambling, these are:

·         ensuring that gambling is conducted in a fair and open way;

·         protecting children and other vulnerable persons from being harmed or exploited by gambling; and

·         preventing gambling from being a source of crime or disorder, associated with crime or disorder, or used to support crime.

In carrying out these functions, we may process personal information for purposes including:

·         considering and determining licence, approval and other regulatory applications;

·         assessing the suitability, integrity, competence and fitness and propriety of licence holders and individuals associated with regulated businesses;

·         supervising and monitoring compliance with gambling legislation, licence conditions and other regulatory requirements;

·         gathering, assessing and using information relevant to our statutory regulatory functions;

·         carrying out inspections and investigations, making regulatory decisions and taking regulatory or enforcement action;

·         carrying out our statutory functions relating to anti-money laundering, counter-terrorist financing, proliferation financing, sanctions and related financial crime risks;

·         verifying identity, ownership and control, source of funds and source of wealth, and undertaking appropriate screening and due diligence;

·         considering complaints, disputes and other information brought to our attention;

·         cooperating with and providing regulatory assistance to other regulators, public authorities and law enforcement agencies in the Isle of Man and overseas;

·         protecting players, minors and other vulnerable persons;

·         communicating with licence holders, applicants and other persons about regulatory matters;

·         consulting on regulatory, policy or legislative matters;

·         carrying out research, analysis and statistical or policy-development work in support of our regulatory functions;

·         obtaining legal advice and establishing, exercising or defending legal rights;

·         meeting statutory reporting, audit and accountability requirements; and

·         publishing regulatory information where authorised or required in connection with our statutory functions.

The licensing, suitability, ownership, management, inspection and enforcement purposes above reflect functions conferred on the Commission under legislation including the Online Gambling Regulation Act 2001. 

The Commission's AML/CFT functions expressly include regulatory oversight, returns, inspections and investigations, information gathering and sharing, and sanctions under the Gambling (Anti-Money Laundering and Countering the Financing of Terrorism) Act 2018. 

The Commission is also expressly empowered to provide and receive mutual assistance with other gambling regulatory authorities, subject to the statutory controls on disclosure.

Information obtained for one regulatory purpose may also be used for another compatible statutory or regulatory purpose where this is lawful, relevant and necessary.

The GSC ensures that it only processes personal data if at least one of the following applies:

• The data subject has given consent to the processing of his or her personal data for one or more specific purposes;

• The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

• The processing is necessary for compliance with a legal obligation (i.e. European or Manx law) to which the GSC is subject;

• The processing is necessary in order to protect the vital interests of the data subject or of another natural person;

• The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the GSC by European or Manx law;

• The processing is necessary for the purposes of the legitimate interests pursued by the GSC, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

As a statutory regulatory body, the Commission processes personal data where necessary for the exercise of its statutory functions and powers. The primary lawful basis for such processing is Article 6(1)(e) of the Applied GDPR, read with regulation 10 of the GDPR and LED Implementing Regulations 2018, which provides for processing necessary for the exercise of functions conferred by enactment or exercised by a Statutory Board.

Consent

The Commission does not generally rely on consent to process personal data where the processing is necessary for the exercise of its statutory regulatory functions and powers.

Where consent is the appropriate lawful basis for a specific processing activity, we will ask for it before processing your personal data. Consent is voluntary and may be withdrawn at any time without affecting the lawfulness of processing carried out before it was withdrawn.

Where a service depends on your consent, withdrawing consent may mean that we are unable to continue providing that particular service.

In carrying out our statutory functions, the Commission may share personal information with other organisations where this is necessary and lawful. This will usually be for regulatory, supervisory, investigative or enforcement purposes, or to enable another public authority or regulatory body to exercise its statutory functions.

Depending on the circumstances, recipients may include:

·         Isle of Man Government Departments and other public authorities;

·         gambling and other regulatory authorities, including overseas regulators;

·         law enforcement agencies and the Financial Intelligence Unit;

·         tax, customs and other competent authorities;

·         sports governing bodies and betting integrity organisations;

·         courts, legal authorities and other bodies where disclosure is required or permitted by law;

·         auditors and other professional advisers where disclosure is necessary for regulatory purposes; and

·         service and technology providers processing personal information on our behalf.

This may include sharing information for the prevention, detection or investigation of crime, taxation and gaming duty, anti-money laundering, counter-terrorist financing, proliferation financing and proceeds of crime purposes.

We will only disclose personal information where there is an appropriate legal basis for doing so and will limit the information disclosed to what is relevant and necessary for the purpose. Where another organisation requests information from us, the fact that a request has been made does not, by itself, mean that information will be disclosed.

Where a disclosure involves an international transfer of personal data, the requirements described in our International Transfers section will also apply.

Regulatory Audits

As part of its statutory regulatory functions, the Commission may share personal information with auditors appointed or approved in accordance with applicable licensing or regulatory requirements, where this is necessary for the purposes of carrying out an audit.

Any access to personal information will be limited to what is relevant and necessary for the purposes of the audit. Auditors will be required to maintain appropriate confidentiality and security arrangements and to use personal information only for the purposes for which access has been provided. Access will be restricted to authorised persons and will be subject to any applicable data protection, professional or regulatory obligations.

Where appropriate, the Commission will put in place contractual or other safeguards governing access to, use, security, retention and disclosure of personal information.

Player Information

The Commission may process personal information about players as part of its statutory regulatory functions. This may include information provided directly by players when making enquiries, seeking assistance or raising complaints or disputes concerning a licensed operator.

We may also collect or receive player information from licensed operators where this is relevant to the exercise of our statutory functions, including for regulatory supervision, inspections, enquiries, complaints or disputes, and the protection of minors, self-excluded persons and other vulnerable persons.

Where necessary for these purposes, we may also share relevant player information with a licensed operator, for example to make enquiries, verify information, investigate a matter or enable the operator to respond to an issue raised with us.

We will only obtain, use or share player information where it is relevant and necessary for the regulatory purpose concerned and will handle it in accordance with this Privacy Notice.

Complaints

Where you make a complaint or raise a concern about a licensed operator, we will treat the information you provide appropriately and with due regard to confidentiality. We may, however, need to share relevant personal information with the operator or another party where this is necessary to consider the matter properly, obtain a response or take appropriate regulatory action.

This may include your identity where it is relevant and necessary to deal with the matter. If you ask us not to disclose your identity, we will take this into account and, where possible, respect your wishes. However, there may be circumstances where the matter cannot reasonably be progressed without disclosing your identity. Where appropriate and practicable, we will explain this to you before doing so.

We may also receive anonymous complaints or concerns. We will consider the information provided, although remaining anonymous may limit our ability to verify the information, seek further details or take action in response.

We will limit any personal information disclosed to what is relevant and necessary for the purpose concerned.

Regulatory inspections and compliance checks

As part of its statutory regulatory functions, the Commission carries out inspections and other compliance checks in relation to licensed operators. In doing so, we may collect, review or verify personal information where necessary to assess compliance with applicable regulatory requirements.

This may include personal information relating to:

·         players, including information required to assess compliance with requirements relating to minors, self-excluded persons and other vulnerable persons;

·         directors, controllers, key officials and other individuals associated with the management or operation of a licensed business;

·         employees and other persons performing regulated or relevant functions; and

·         individuals whose information is contained within records reviewed as part of anti-money laundering, counter-terrorist financing, proliferation financing or other regulatory compliance checks.

Depending on the nature of the inspection or review, we may obtain this information directly from the individual, from the licensed operator, or by examining relevant records and systems.

We will only collect, access or use personal information to the extent that it is relevant and necessary for the regulatory purpose concerned and in accordance with our statutory functions and applicable data protection law.

This Privacy Notice explains how we obtain and use personal information from third parties as part of our statutory functions. Where required, we may provide further information about particular processing activities.

 In carrying out our statutory regulatory functions, we may obtain personal information about individuals from sources other than the individual concerned. This may include information:

• provided by licence applicants or licence holders about directors, controllers, key officials, funders or other individuals associated with an application or licensed activity;
• obtained from third parties to verify information provided to us or to assess the suitability, fitness or propriety of an individual or licence holder;
•  provided by other regulatory bodies, law enforcement agencies or public authorities;
• provided by complainants, members of the public, witnesses, experts or other third parties in connection with our regulatory, supervisory or investigative functions; and
•  otherwise provided to us where relevant to the exercise of our statutory functions and powers.

We use this information where necessary to carry out our statutory functions, including licensing, supervision, suitability assessments, regulatory investigations and enforcement.

 There may be circumstances where providing some or all of the information normally required by data protection law would prejudice a regulatory or criminal investigation, or otherwise undermine the exercise of our statutory functions. Where this arises, we will consider whether an applicable exemption or restriction permits that information to be withheld or delayed.

In carrying out its statutory functions, the Commission may need to transfer personal data outside the Isle of Man. This may include responding to requests for information from overseas gambling regulators about individuals or organisations with whom the Commission has, or has had, a regulatory relationship, as well as sharing information with overseas regulators, law enforcement agencies, public authorities, sports governing bodies and other organisations where necessary for regulatory, supervisory, investigative or enforcement purposes.

Where personal data is transferred internationally, the Commission will ensure that the transfer complies with applicable data protection law. Depending on the country and circumstances of the transfer, this may include relying on an adequacy decision, appropriate safeguards, or another lawful basis for the transfer permitted under data protection law.

Before transferring personal data, the Commission will consider the purpose and necessity of the disclosure, the information to be shared, the recipient and the applicable legal basis for the transfer. Where appropriate, additional safeguards will be applied having regard to the nature and sensitivity of the information and the circumstances of the transfer.

Where the Commission is processing personal data for law enforcement purposes under the Applied LED, any international transfer will be considered separately in accordance with the requirements applicable to law enforcement processing.

We take the security and confidentiality of personal information seriously and have appropriate technical and organisational measures in place to protect it against unauthorised or unlawful access, use, disclosure, alteration, loss or destruction.

Access to personal information is restricted to authorised personnel who require it for their role. Additional access restrictions may be applied to particularly sensitive or confidential information.

Personal information held electronically is stored within secure systems provided or supported by Isle of Man Government, Government Technology Services and other approved service providers. Appropriate security measures are applied to these systems, including access controls and measures designed to protect the confidentiality, integrity and availability of information.

Where third-party service providers process personal information on our behalf, appropriate contractual and security arrangements are put in place and their access is limited to what is necessary to provide the relevant service.

Any physical records containing personal information are stored securely with access limited to authorised personnel or approved storage providers.

We retain personal information only for as long as necessary in accordance with our regulatory requirements and records retention arrangements.

Articles 12 to 22 of the Data Protection (Application of GDPR) Order 2018 set out the rights you have as a data subject. These rights are not absolute and may be subject to restrictions or exemptions in particular circumstances.

If you have any concerns about how we collect or process your data, you can write to our Data Protection Officer using the address above or by email to DPO-GSC@gov.im.

You also have the right to request the Isle of Man’s Information Commissioner (ICO) to undertake an assessment as to whether the processing of your personal data has been carried out in accordance with the provisions of the Isle of Man Data Protection Legislation.

Further information regarding complaints to the ICO can be obtained by calling +44 1624 693260. Information can be found on their website below. 

If you have any questions about how we process your personal information, you can contact our  Data Protection Officer regarding your rights.

By email: DPO-GSC@gov.im

By telephone:  01624 698322

In writing: 

Data Protection Officer

Gambling Supervision Commission

Ground Floor, St George’s Court,

Myrtle Street, Douglas,

Isle of Man, IM1 1ED

We may update this Privacy Notice from time to time to reflect changes in our processing activities, legal or regulatory requirements, or our practices. Where significant changes are made, we will provide a prominent notice on our website.

Overview

This section provides specific information on privacy matters for individuals applying for jobs at the GSC. 

Why does the GSC collect personal data from job applicants?

We collect and processes personal data relating to job applicants in order to carry out its recruitment process. We are committed to being transparent about how we collect and use that data and to meeting its data protection obligations.

The Isle of Man has data protection laws describing what an organisation must do if it processes personal data and what rights you have in respect of your data. Please see the Information Commissioner’s website for more details: https://www.inforights.im/.

What personal data does the GSC collect about you?

We collect the following personal data about you as part of the recruitment process:

• Full name, previous name(s)
• Contact details including email address, telephone numbers, home address
• Details of your academic and professional qualifications, skills, experience and employment history, including start and end dates with previous employers
• Information about your current employment, remuneration and benefits
• Information you supply about how you meet the criteria for the role
• Information about your criminal record (including details of any spent convictions if you are applying for the roles of a member of the Commission, Chief Executive Officer, Deputy Chief Executive Officer or Director)
• Information on disciplinary action, disqualifications, suspensions, civil litigation, bankruptcy or disqualifications
• Information about your entitlement to work in the Isle of Man
• Details of your employment, academic or personal references and contact details for your referees.

The following personal data categories will only be collected and processed by us following successful application and acceptance of job offer:

• Gender, marital status, date of birth
• Previous address(es), nationality, your passport and other identity documents

We may collect this information in a variety of ways. For example, data may be collected from:

• application forms;
• CVs;
• your passport; 
• other identity documents such as your driving licence;
• correspondence with you; or
• through interviews.

We may also collect personal data about you from the following sources:  

• references supplied by former employers,
• information from providers of employment background checks,
• information from criminal record checks
• right to work checks, including work permit and immigration checks.

We will seek information from third parties if a job offer has been made to you and will seek your permission before doing so.

Why does the GSC process personal data about you?

We will only process your personal data if it has a lawful basis for doing so. The main lawful bases that apply to our processing of personal data of job applicants are:

Processing is necessary in order to take steps at your request prior to entering into an employment contract.

As part of the recruitment process, we need to process certain personal data prior to entering into a contract with you. We will not use your data for any purpose other than for recruitment purposes and you are free to withdraw from the process at any time. Should your job application be successful and you subsequently become an employee of the GSC, other lawful bases for processing your personal data will then apply (there is a separate Employee Privacy Notice)

Processing is necessary for compliance with a legal obligation to which the GSC is subject (e.g. for the purposes of recruiting staff).

In some cases, we need to process personal data to ensure that it is complying with its legal obligations. For example, it is a requirement to check a successful applicant’s eligibility to work in the Isle of Man before employment starts.

Processing is necessary for the purposes of the legitimate interests pursued by the GSC or by a third party.

We have a legitimate interest in processing certain personal data about you during the recruitment process and for keeping records of the process.

Processing data from job applicants allows us to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide on to whom to offer a job. We may also need to process data from job applicants to respond to and defend against legal claims.

Does the GSC process any sensitive personal data about you?

Some sensitive personal data (referred to as ‘special category’ data), about job applicants (such as information about health or medical conditions) may be processed by us to carry out our employment law obligations, such as those in relation to prospective employees with disabilities.

The main conditions that apply to the processing of special category data of job applicants by us are as follows:

• Processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the GSC or of the employee in the field of employment and social security and social protection law.

• Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Isle of Man law.

• The job applicant has given explicit consent to the processing of their personal data for one or more specified purposes.

Should your job application be successful, we will establish if you have any health or disability issues for which we may need to make suitable adjustments to planned working arrangements. We will do this only after if job offer has been made. Such processing of personal data is necessary for us to carry out its obligations and exercise specific rights in relation to employment.

We will only process health data which is necessary to satisfy its duty of care to job applicants. Any health data will be held securely and will only be shared where necessary to protect the interests of job applicants and with the express permission of the individual concerned.

We processes personal data about job applicants relating to criminal convictions and offences in order to carry out its obligations and exercise specific rights in relation to employment.

If you apply for any of the following roles, you will be required to provide a record of any spent convictions as part of enhanced considerations around your suitability for the role, by virtue of Part 2 (4) of Schedule 1 of Rehabilitation of Offenders Act 2001 (Exceptions) Order 2018:

• A member of the Gambling Commission

• The Chief Executive Officer

• Deputy Chief Executive Officer

• Director

How does the GSC store and protect your personal data?

Personal data will be stored in different places depending on the circumstances. These may include your application record, in Human Resources (‘HR’) management systems and on other IT systems (including email). The GSC will share your data with other data controllers and data processors where this is necessary for the purposes described in this privacy notice. Please see below for further details.

We take the security of your personal data seriously and it has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed and it not accessed except by relevant employees in the performance of their duties.

How long does the GSC keep your personal data for?

If your application for employment is unsuccessful, we will hold your personal data for 12 months after the end of the relevant recruitment process to meet obligations under the Equality Act 2017. At the end of that period your data will be deleted or destroyed.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will be held are set out in our records retention schedule.

Does the GSC share your personal data with other parties?

Your information may be shared with relevant GSC staff for the purposes of the recruitment exercise. This includes the HR team, interviewers and any other members of staff who are decision makers in the recruitment process.

We will not share your data with third parties unless your application for employment is successful and it makes you an offer of employment. Once you give permission to do so, we will share your data with former employers to obtain references for you. 

We will not transfer your personal data to countries outside the Isle of Man without either your consent or an appropriate lawful basis for doing so. Similarly, we do not authorise third parties to transfer your data outside the Isle of Man unless either of those conditions are met.

The GSC is under an obligation to ensure that any personal data transferred outside of the Isle of Man, the European Economic Area (‘EEA’) or a jurisdiction with an adequacy decision for the European Union’s General Data Protection Regulation (‘GDPR’) (such as the United Kingdom) is subject to appropriate safeguards.

What rights do you have over your personal data?

 As a data subject, you have a number of rights over your personal data and how it is processed:

Right to be informed

This Privacy Notice explains how we collect and process your personal data as an applicant for a job within the GSC.

Right of access

You can access and obtain a copy of your data and certain processing information on request.

Right to rectification

You can request that we change incorrect or incomplete information.

Right to erasure

You can request that we delete your data, for example where the data is no longer necessary for the purposes of processing.

Right to restrict processing

You can request that we restrict processing of your data, for example where there is no longer an appropriate basis for processing.

Right to data portability

You can request personal data you have provided to us in a structured, commonly used and machine readable format where it is processed by automated means. You may also request that we transmit this data to another controller.

Right to object

You can object to the processing of your data by us. This only applies in certain circumstances and will therefore depend on the purpose and lawful basis for processing.

Rights related to automated decision making including profiling

The GSC does not currently carry out any automated decision making.

If you would like to exercise any of these rights, please contact the GSC's Data Protection Officer (see contact details section).

If you believe that the GSC has not complied with your data protection rights, you can discuss your concerns with our Data Protection Officer (see below). If you are not satisfied with a response you receive from us then you can make a complaint to the Isle of Man Information Commissioner, whose details can be found on www.inforights.im. You may have a right to other remedies.

What happens if you do not provide personal data?

You are under no statutory or contractual obligation to provide data to the GSC during the recruitment process. However, if you do not provide the information, we may not be able to process your application properly or at all.

Changes to this Privacy Notice

This Privacy Notice may change. If any significant change is made to this Privacy Policy we will notify you.