Player Data Residency for iGaming Operators, Jurisdiction by Jurisdiction (2026)

iGaming data residency is a patchwork, not one rule. As of October 2026, Sweden's main rule puts the gambling system in Sweden, Brazil's Portaria 722/2024 requires data centres in Brazil (while Brazil's fixed-odds market is being wound down), Malta and Spain accept foreign hosting if the regulator can see live data, and the UK sets no hosting mandate. This guide maps each rule and what a customer data platform (CDP) must therefore do.

Who this is for: compliance, architecture and data-protection leads at licensed operators who run one player data layer across several licences. It belongs to our customer data platform for iGaming operators hub.

Four kinds of rule behind the map

Most hosting and data rules fall into four patterns, and a single licence often combines two of them.

• Localise. The gambling system or its data must sit in-country: Sweden (main rule), Brazil (data centres), New Jersey (primary equipment in Atlantic City).
• Locate anywhere, prove access. Hosting is open but the regulator must reach live data: Malta (replica in Malta), Spain (inspection wherever the unit is), the UK (data on request).
• Feed the regulator. A supervisory data feed is mandatory: Germany's Safe-Server, Brazil's SIGAP, Spain's secure database, the Dutch CRUKS exclusion register.
• Limit the use. Retention clocks and purpose limits apply: Germany deletes five years after account closure, and Alberta restricts what player information may be used for.

Player data residency by jurisdiction

Every row was reviewed on 2026-10-17; where we could not reach a primary source the row says so. Confidence High means we read the legal or regulator text; Medium means the text was read but is silent on location, dated, or only partly verified; Low means we could not verify a primary source and the row needs checking before you rely on it.

Verified from primary text

| Alberta (AGLC / AiGC) | No server-location rule found in the June 2026 standards; players must be physically in Alberta, VPN and proxy evasion must be blocked; off-site immutable backups | Logs available to AGLC on request; API link to AGLC's central self-exclusion system; event and security logs kept one year online plus seven years archived | Alberta privacy legislation; player information may be used only for the lottery schemes AGLC or AiGC run, so test any marketing use | 89 | 2026-10-17 | Medium | | Germany (GGL) | No server-location rule in the treaty text. For sports betting, poker and virtual slots the applicant needs an EU or EEA seat, payment accounts in Germany or an EU bank, and real-time interfaces to check all gaming processes | Operator-run Safe-Server stores supervision data immutably and pseudonymised, with direct authority access; mandatory LUGAS limit and activity files; OASIS block list | GDPR; player personal data kept five years after account closure, then deleted | 101125 | 2026-10-17 | High | | Sweden (Spelinspektionen) | Main rule: the licence holder's gambling system must be located in Sweden; exemptions on application | Authority may access premises and equipment; for exemptions an accredited body assesses whether remote inspection is possible | GDPR and Swedish data protection law | 1225 | 2026-10-17 | High | | Spain (DGOJ) | No in-Spain hosting mandate for the central gaming unit or its replica; the regulator may require named secondary units in Spain | Operator guarantees inspection wherever equipment sits; secure lines for real-time monitoring from Spain; secure database kept at least six years | GDPR and Spanish data protection law | 1325 | 2026-10-17 | High (2011 text; regulator then named CNJ) |

Secondary or not yet verified

For a wider, non-gaming view see data residency requirements by country and the data residency map.

What operators ask most often

UKGC data hosting

The UK is the clearest "no mandate" case. Section 36 of the Gambling Act 2005 decides when a licence is needed: if at least one piece of remote gambling equipment is in Great Britain, or none is but the facilities are used there 1. In its 2021 response on remote key equipment the Commission explained that physical inspection of equipment is unnecessary because the data held on it is what matters, and that access to data stays a licence requirement 4. In the LCCP version effective 29 July 2026 that condition is 2.1.1 2. The practical test for a customer data platform is evidence, not geography: can you hand the Commission the data, in its format, when asked, with logs and backups to match the RTS security requirements 3?

MGA hosting requirements and replication

Malta's guidance note is principles-based. It says hosting may be in Malta, any EEA state or a third country the Authority accepts, assessed case by case; it names player, financial and gaming database servers as critical components; and it will be satisfied when critical components sit on a private cloud not shared with other tenants, with virtual private cloud allowed if integrity is not at risk 5. Where infrastructure is abroad, the MGA's route to real-time access is a live replica of regulatory data (player details, financial and game-play transactions) in Malta, with documented immediate physical and electronic inspection access 5. Whether a given customer data platform counts as part of that technical infrastructure is a question to settle with the MGA before go-live.

Ontario and Alberta

Ontario's Registrar's Standards for Internet Gaming took effect on 4 April 2022 and, in the IT standards we read, require a disaster recovery site and access logging but say nothing on where data sits 7. Alberta, where AGLC says registered platforms can operate from 13 July (2026), regulates the player's location more than the server's: only players physically in Alberta may play, location evasion must be blocked, and logs are kept one year online and seven years archived 89. Its purpose limit on player information is the clause most relevant to CRM and marketing use.

Brazil: the betting data centre requirement in 2026

Article 4 of Portaria SPA/MF 722/2024 requires betting systems and their data to be kept in data centres in Brazilian territory, observing the LGPD. Hosting abroad is possible only in countries with a civil-and-criminal legal-cooperation agreement, and only if the player gave specific prior consent to the transfer, the ministry has secure unrestricted remote and on-site access, the data is continuously replicated in Brazil, and a business continuity plan exists. The data centre must hold ISO 27001 certification and recorded data is backed up for at least five years 14.

Germany, Sweden and Spain: three different answers

Germany regulates the data feed, not the data centre: the operator runs a Safe-Server, pseudonymised, that the authority downloads from 1011. Sweden regulates the location: the system sits in Sweden unless exempted 12. Spain regulates access: the central gaming unit and its replica can be anywhere if inspection and real-time monitoring from Spanish territory work, and the regulator can ask for named secondary units on Spanish soil 13. One platform cannot satisfy all three by accident.

Architecture patterns for multi-jurisdiction operators

Four patterns cover almost every row above. They combine; none replaces the others.

1. In-country core. Identity, wallet-linked records and gameplay-linked behaviour for a localising market sit in a store inside that country. Fits Sweden, Brazil and New Jersey.
2. Regulator-accessible replica. A continuously updated read-only copy, with a documented and tested access path, sits where the regulator requires. Fits Malta, Brazil's foreign-hosting exception and Spain's secondary units.
3. Per-jurisdiction tenants. Each licence gets an isolated deployment with its own keys, so a change in one market's rules cannot force a migration elsewhere. Operator-owned deployments (on-premise, in your own cloud account, or sovereign) make this practical; see on-premise, private cloud and self-hosted customer data platforms and residency versus sovereignty.
4. Central analytics on pseudonymised data. Group reporting and modelling use pseudonymised records, with re-identification keys held in the licensing country. Germany already requires pseudonymisation on the Safe-Server 10. Any flow out of the EU or UK still needs a transfer mechanism; see GDPR transfers after Latombe.

A reference deployment on PrivyCDP's site, a sovereign iGaming operator in the Middle East and North Africa, runs air-gapped AI inference and in-region decisions at low latency. It illustrates pattern 1 and 3 rather than proving any particular licence's acceptance.

The responsible-gambling data trail

Residency rules interact with retention. The audit trail for limits, exclusions and interventions has its own clock in several markets.

Keep responsible-gambling evidence in the same residency boundary as the player record it explains. Our pieces on single customer view and real-time interventions cover what to record.

Residency review checklist

1. List every licence and note, for each, the system-location rule, the regulator-access rule, the retention rule and the personal-data law.
2. Decide whether your customer data platform counts as a gambling system, player database or betting system under each rule.
3. Assign each data store to a pattern: in-country core, replica, tenant or pseudonymised central.
4. Build and document a regulator access path for each replica, with a named owner and a test date.
5. Pseudonymise before any cross-border analytics and keep keys in the licensing country.
6. Confirm a transfer mechanism for every EU or UK flow that leaves the region.
7. Reconcile retention clocks with deletion duties, and record legal holds.
8. Log every regulator access and every export in an append-only audit store.
9. Run a regulator-inspection drill and a link-loss drill at least yearly.
10. Re-check each rule every quarter and after any regulator announcement.

If you are mapping these rules onto a platform decision, start with our deployment qualification to test whether a customer-owned deployment fits your licence set, then return to the iGaming hub for the related guides.