Yes. The DGOJ's 2014 technical resolution sets what Spanish operators record about players, how long they keep it, and what you can see.
Yes, in detail, and the requirements are published. They sit in the DGOJ resolution of 6 October 2014 setting out the technical specifications for gaming systems licensed under Law 13/2011, published in the Boletín Oficial del Estado as BOE-A-2014-10302.
What follows is what that document actually requires, with its own section numbers, so you can check any of it.
Every licensed Spanish operator keeps a Registro de usuario. Section 2.1.1 sets out what goes in it.
For residents of Spain, the NIF or NIE, held in a standard format. For non-residents, an equivalent identity document, plus the full name.
Alongside that: date of birth, sex, address, nationality, email address and telephone number. Non-residents also have their country of residence recorded.
The registry also carries a tax residence code for the participant.
Section 2.1.2 requires digital copies of identity documents to be kept.
Section 2.1.3 requires the operator to record the player's acceptance of the gaming contract, and any later changes to it.
So the operator holds not only your identity data but a copy of the document you proved it with, and a record of what terms you agreed to and when.
This is the part the question usually turns on.
Sections 2.1.4 and 2.1.5 cover records of identity checks and registry queries, logged to the date, hour and minute. Those must be kept for the life of the registration and, in the resolution's own words, "durante los seis años siguientes a su cancelación o anulación", for the six years following its cancellation or annulment.
Closing your account does not end the retention. It starts the six year clock.
Other records carry their own periods. Audit, exception and security event logs must be kept for at least two years under section 4.9. Penetration and vulnerability test reports must be kept for at least four years under 4.17. Binaries for software versions used in the last four years are kept under 4.13. Logs on physical accessory terminals are kept for at least ninety days under 3.7.3.3.
Some records have no stated period in the resolution, including cancelled registrations under 2.1.7, which must be retained with the time and reason for cancellation, and suspensions under 2.1.8 and 2.1.9.2.
Section 2.1.12 requires all access attempts to the account to be logged for later audit, whether or not they succeeded.
Section 2.2.8 requires changes to deposit limits to be recorded with the date and the reason.
Section 1.2.8 defines the gaming operations store as "el dispositivo ubicado en España", the device located in Spain.
That requirement attaches to the monitoring store of gaming operations. The section covering the user registry itself does not state a location, so the in-Spain rule should be read as applying to the operations store specifically rather than to every record an operator holds.
One provision runs the other way and is worth knowing.
Section 2.2.3 requires that participants can see their own account balance and their plays for at least the last thirty days.
So if a Spanish licensed operator tells you your own recent play history is unavailable, that is contrary to the technical specification it is licensed under.
To confirm an operator holds a Spanish licence in the first place, see how to check a DGOJ licence in Spain.
Resolución de 6 de octubre de 2014, de la Dirección General de Ordenación del Juego, technical specifications for gaming systems under Ley 13/2011. BOE-A-2014-10302. https://www.boe.es/buscar/doc.php?id=BOE-A-2014-10302
| Record | Minimum period | Section |
|---|---|---|
| Identity checks and registry queries | Registration, plus six years after cancellation | 2.1.4, 2.1.5 |
| Audit, exception and security logs | Two years | 4.9 |
| Penetration and vulnerability test reports | Four years | 4.17 |
| Software binaries in use | Versions from the last four years | 4.13 |
| Accessory terminal logs | Ninety days | 3.7.3.3 |
| Your own visible play history | At least the last thirty days | 2.2.3 |
No. Under sections 2.1.4 and 2.1.5 the records of identity checks and registry queries are kept for six years following cancellation or annulment of the registration. Cancellation starts that period rather than ending it.
Section 1.2.8 defines the gaming operations store as the device located in Spain. That applies to the monitoring store of gaming operations. The section on the user registry does not itself state a location, so this page does not claim a blanket in-Spain rule for every record.
At least the last thirty days of your plays and your account balance, under section 2.2.3. Broader rights over your personal data come from data protection law rather than from this resolution.
Every requirement is sourced to the DGOJ resolution of 6 October 2014, BOE-A-2014-10302, by section number. Last reviewed October 15, 2026.