A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall detail the controls to assure that all data the Commission requires to be maintained under M.G.L. c. 23N or 205 CMR is appropriately segregated and controlled to prevent unauthorized access. Sports Wagering Operators must provide the Commission with access to all such data, upon request, within a time provided for by the Commission. A Sports Wagering Operator must retain such data for a minimum of five years.
205 CMR, § 238.42