5. What changes affect player-data deletion and overseas access?

California DROP: test the supplier’s classification and deletion process

From 1 August 2026, covered data brokers must access California’s deletion mechanism at least every 45 days and process applicable requests, subject to exceptions. The definition concerns businesses knowingly collecting and selling personal information about consumers with whom they lack a direct relationship; a scouting supplier is not automatically a data broker merely because it sells a subscription. (cppa.ca.gov)

Recommended player data API test: ask the supplier to demonstrate a correction or deletion event using an authorised test record. Check whether it reaches the warehouse, search index, cached reports and derived datasets, and whether the system records the reason and scope of the change.

For a Player Data Joinability Check, retain distinct statuses for missing source coverage, identity uncertainty, a correction, a restriction and deletion. This is our recommended design—not a claim that every missing player record reflects a legal request.

US Data Security Program: scrutinise access, not just hosting

The Department of Justice’s Data Security Program took effect on 8 April 2025, with specified diligence, audit and reporting requirements effective 5 October 2025. It remains an existing control to revisit during supplier and subcontractor changes. (justice.gov)

Its scope depends on covered transactions involving access by countries of concern or covered persons to government-related data or bulk US sensitive personal data. Categories and thresholds matter; this is not a blanket prohibition on international football analytics or a rule triggered by any overseas vendor. (justice.gov)

Action: obtain a subprocessor and remote-access map. Ask who can access which datasets, from where, under whose ownership and for what task. Escalate sensitive-data aggregation and relevant access arrangements rather than accepting US hosting as the complete answer.