The Problem
Most operators bring in an HR or background-screening vendor the way they would bring in any other supplier, comparing price, turnaround time and how well the platform talks to the applicant tracking system, and that is reasonable for most things but not this one. What that vendor actually handles, for a meaningful slice of the workforce, is criminal record data, financial history for certain roles, employment references and check results that will eventually sit inside the operator’s own evidence trail when someone applies for a personal licence, a key employee registration or an equivalent fit and proper finding, whichever jurisdiction the operator is licensed in. If the vendor’s checks are shallow, or its record keeping would not survive a regulator asking to see it, or its handling of that data falls short of what the relevant data protection authority expects, the operator carries the consequence twice, once when the licensing regulator asks why the check fell short, and again when the data protection authority asks why the vendor was never properly assessed. That data sits in its own, more sensitive category almost everywhere it is regulated, under the UK’s rules, the EU’s version of the same regulation, or the state privacy and gaming laws that apply to a US operator, so a signed order form and a line in a privacy policy does not clear the bar any of them set.
How It Actually Works
In the UK, start with what the check feeds into. The Gambling Commission’s personal licence checks, for England and Wales applicants, run as Basic DBS checks completed electronically within about a week, moving to a Standard DBS check, taking up to three weeks, where a conviction has been declared, with Scottish applicants going through Disclosure Scotland on a similar timescale. Since 2024 the Commission has widened who needs a personal management licence to cover chief executives, board chairs and anyone with anti-money laundering or counter-terrorist financing responsibility, and working out who that covers is the operator’s own job. An HR or screening vendor usually sits upstream of all this, running the reference and pre-employment checks that decide whether someone is even put forward for one of these roles, so its evidence becomes part of the operator’s audit trail before the person applies for anything themselves. The Information Commissioner’s Office is specific about what a controller has to establish before appointing a processor: recognised standards for the processing involved, documented security policies rather than assurances, and a contract covering the eight minimum terms the ICO sets out, including a defined regime for sub-processors requiring prior written authorisation, since screening providers often route parts of a check through their own specialist sub-contractors. The ICO is clear that a controller remains primarily responsible for compliance regardless of what the contract says, so if the vendor’s process is the weak point, both regulators land on the operator first.
The picture looks different for a US operator, partly because there is no single federal data protection law equivalent to the UK’s, so due diligence runs state by state alongside a separate track of gaming regulation. California is the clearest example: the exemption that used to keep employee and applicant data outside the California Consumer Privacy Act expired on 31 December 2022, and the California Privacy Protection Agency confirms the law now applies to employees and job applicants, with separate obligations on any service provider, which is what a background-screening vendor is, meaning a service provider agreement doing similar work to the ICO’s eight terms is needed even though the two laws come from different traditions. Several state gaming regulators go further and vet the vendor directly rather than only through a privacy framework. New Jersey requires any company providing goods or services connected to casino or sports wagering operations to hold a casino service industry enterprise licence, involving fingerprinting and a full criminal history check on the vendor’s own qualifying personnel, run by the Division of Gaming Enforcement itself. A US operator is often working two assessments in parallel, a privacy question decided state by state and a fitness question the gaming regulator answers directly about the vendor, neither of which maps onto the UK’s processor-only model.
For an operator holding both a UK licence and one from an EU member state, such as Malta, UK GDPR and the EU’s GDPR read almost identically but have been separate instruments since the UK left the EU, each sitting alongside its own domestic law. Under Article 10 of the EU regulation, processing criminal conviction and offence data is lawful only under the control of an official authority or where a member state’s own law specifically authorises it, so the conditions a screening vendor has to meet depend on which country’s implementing law applies, not on the regulation’s headline text. The Malta Gaming Authority, working with Malta’s data protection regulator, has issued its own guidance to licensees on this since 2018, sitting on top of the EU regulation rather than restating it. Treating ICO-facing paperwork for a UK vendor as if it also covers an EU-licensed entity is where that gap tends to open.
A Practical Way In
Five questions worth putting to any HR or screening vendor before they get access to anything connected to licensing or fit and proper decisions, not as a full assessment but a starting filter, adjusted to the jurisdictions the operator is actually licensed in.
One, can the vendor show, with evidence rather than a claim, that its checks map to how the relevant licensing regime actually works in each jurisdiction, a UK DBS check, a US state gaming licence investigation, an EU member state’s own criminal record procedure, rather than a generic international screening product with a gambling label added on.
Two, where does the criminal record and financial data physically sit, which country’s law governs it, and will the vendor name its own sub-processors or service providers rather than describe them in general terms.
Three, what does the contract say against the minimum terms the relevant authority expects, UK, EU or US state law, and specifically what happens to sub-processor authorisation and to the data on termination.
Four, can the vendor produce a dated, unaltered record of exactly what was checked and when, the kind of thing that would hold up if a fit and proper decision were challenged months later.
Five, if this vendor had a data breach or got a screening result wrong tomorrow, what would the conversation with each relevant regulator sound like, and does the vendor have anything in writing, insurance, indemnity, a breach notification commitment, that would change how that conversation goes.
Where This Goes Deeper
This covers the shape of the assessment, not the detail needed when a specific vendor’s contract is on the table, a sub-processor chain needs mapping across more than one jurisdiction, or a licensing application is due and the paperwork behind it has to hold up to scrutiny. That level of depth, working through an actual contract clause by clause against what each relevant regulator would expect to see, is what an Expert Session is for rather than working it out alone, and it is worth checking whether that fits before signing anything.
Sources
1. UK Gambling Commission, ‘Criminal record checks for PFL holders’, https://www.gamblingcommission.gov.uk/licensees-and-businesses/guide/page/criminal-record-checks-PFL
2. UK Gambling Commission, ‘Licensing requirements’, https://www.gamblingcommission.gov.uk/licensees-and-businesses/guide/page/licensing-requirements
3. Information Commissioner’s Office, ‘What responsibilities and liabilities do controllers have when using a processor?’, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/responsibilities-and-liabilities-for-controllers-using-a-processor/
4. Information Commissioner’s Office, ‘What needs to be included in the contract?’, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/
5. Wiggin LLP, ‘The Gambling Commission outlines new requirements for Personal Management Licences’, 2024, https://www.wiggin.co.uk/insight/the-gambling-commission-outlines-new-requirements-for-personal-management-licences/
6. California Privacy Protection Agency, ‘Frequently Asked Questions’, confirming the employment and job applicant data exemption under the CCPA expired 31 December 2022, https://cppa.ca.gov/faq.html
7. New Jersey Revised Statutes, section 5:12-92, ‘Licensing of casino service industry enterprises’, https://law.justia.com/codes/new-jersey/title-5/section-5-12-92/
8. European Union, Regulation (EU) 2016/679 (General Data Protection Regulation), Article 10, ‘Processing of personal data relating to criminal convictions and offences’, https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
9. GVZH Advocates, ‘Malta Gaming Authority publishes guidelines on the General Data Protection Regulation (GDPR)’, 8 May 2018, https://gvzh.mt/insights/malta-gaming-authority-guidelines-general-data-protection-regulation-gdpr/