Betting and the 100-year secrecy rule: what Brazil's LGPD says about the case
Over the past 24 hours, several media outlets have published reports claiming that the Ministry of Finance has begun denying access to proceedings related to the authorisation of betting operators, invoking the 100-year secrecy rule under the Access to Information Law (LAI). It did not take long for the story to gain widespread attention. However, before any analysis, it is important to separate facts from narratives.
According to information published by the news outlet Estadão and reproduced by several media organisations, requests submitted under the Access to Information Law seeking access to the full betting operator authorisation proceedings were denied by the Ministry of Finance. The reported justification was the presence of personal data relating to shareholders, directors and ultimate beneficial owners of the companies, information protected under Article 31 of the Access to Information Law, a provision that allows access restrictions of up to 100 years in certain situations involving personal data.
So far, there is no ordinance, decree or official government communication establishing a “100-year secrecy rule for betting operators”. What exists are responses to access-to-information requests that reportedly relied on provisions already contained in Brazilian legislation. This distinction is important because part of the public debate has conveyed the impression that a specific rule was created to protect betting companies, something that does not appear in the legislation currently in force.
How betting operator authorisation works in Brazil
Since the approval of Law No. 14,790/2023, known as the Betting Law, the Ministry of Finance has been responsible for the authorisation, regulation, monitoring and supervision of operators seeking to operate legally in the country.
Oversight is carried out through the Secretariat of Prizes and Betting (SPA), a body created specifically to regulate the sector. Its responsibilities include authorising companies, supervising operations, applying sanctions and monitoring compliance with regulatory requirements. To obtain a licence, operators must submit a large amount of documentation and information to the government, including:
- Corporate structure;
- Identification of shareholders and directors;
- Ultimate beneficial owners of the company;
- Financial statements;
- Anti-money laundering programmes;
- Security systems;
- Technical certifications;
- Corporate and operational information.
The entire process is conducted through the Betting Management System (SIGAP), a platform developed by the Ministry of Finance to manage authorisation requests and oversee the regulated market.
The requested documents do not concern bettors or player transactions. They involve information submitted by the operators themselves during the authorisation process, including corporate structures, identification of ultimate beneficial owners, corporate documents, financial statements and compliance policies required by the regulator.
Transparency versus data protection
The debate is not as straightforward as it may seem. Those advocating disclosure of the proceedings argue that the betting industry generates billions of reais and has significant economic and social impact. For this reason, they argue that there is a public interest in understanding who controls authorised companies and what criteria were used to grant licences.
On the other hand, there are legitimate concerns regarding the protection of personal and corporate data. The authorisation proceedings may contain identification documents, financial data, detailed corporate structures, commercial strategies and sensitive information used for regulatory purposes. In various regulated sectors, such as finance and insurance, not all documentation submitted to supervisory authorities is automatically made public.
In this sense, the discussion moves away from being “for” or “against” betting and instead focuses on another question: what is the appropriate balance between public transparency and the protection of sensitive information?
The 100-year secrecy rule
In recent years, the 100-year secrecy rule has become a widely discussed topic in debates surrounding public transparency and politics in Brazil. The issue has gained visibility across different Brazilian governments and in various contexts, prompting transparency experts, civil society organisations and oversight bodies to discuss the limits of applying Article 31 of the Access to Information Law.
In 2023, the federal government introduced changes to the regulation of the Access to Information Law to reinforce that the presence of personal data in a document should not necessarily prevent access to other information of public interest, provided that sensitive data remains protected. The discussion remains ongoing and has raised questions about how to balance transparency, public oversight and personal data protection in regulated sectors of the economy.
Should administrative appeals or challenges be brought before the Office of the Comptroller General (CGU), future rulings may provide greater clarity regarding which parts of betting operator authorisation proceedings should remain protected and which may be disclosed to the public.
Where does the Data Protection Law fit into this discussion?
Although the case has been associated with the 100-year secrecy rule, it can also be linked to Brazil’s General Data Protection Law (LGPD). This is because the authorisation proceedings submitted by betting operators to the Ministry of Finance contain a range of information relating to natural persons, including shareholders, directors, legal representatives and ultimate beneficial owners of the companies. Brazilian legislation establishes that personal data must receive adequate protection, including when held by public authorities.
According to the news outlet A Crítica, the access to information requests sought documents used in the betting operator authorisation process, specifically in the case of 1xBet. These proceedings may include corporate agreements, identification documents, supporting records, financial information, corporate records and various other documents required by regulation. Part of this material contains personal data that, under the legislation, cannot be freely disclosed without legal justification or a public interest that outweighs the protection of privacy.
This is precisely where one of the main points of disagreement arises. Experts in the LGPD and public transparency argue that the existence of personal data in a document should not automatically prevent access to its contents. The Access to Information Law itself adopts the principle that public information should be disclosed whenever possible, allowing protected information to be redacted or otherwise treated in order to preserve the privacy of those involved. Under this interpretation, information such as CPF numbers, residential addresses, signatures, identity document details and personal banking information could be removed, while the remaining information of public interest would remain accessible for consultation.
On the other hand, betting operator authorisation proceedings do not contain only personal data. They often also contain highly specific corporate information, including corporate structures, financial statements, compliance policies, anti-money laundering mechanisms, internal security procedures and other elements considered sensitive from a business perspective. Although such information is not necessarily protected under the LGPD, it may be subject to other forms of protection provided by legislation, particularly when trade secrets or commercially sensitive information are involved.
A legal perspective on the issue
In an exclusive interview with SiGMA News, professor and data protection specialist Maria Elisa commented that the LGPD cannot be used as grounds to indiscriminately protect corporate, technical, operational or compliance documents. According to her, the legislation protects data relating to identified or identifiable natural persons, but does not automatically apply to corporate information, ownership structures, financial statements or regulatory documents submitted by operators during the authorisation process.
“The LGPD does not authorise secrecy; it regulates processing.”
The specialist also highlights that the LGPD itself provides anonymisation mechanisms capable of protecting personal data without requiring the complete withholding of documents. In her assessment, anonymisation represents an alternative capable of protecting personal information without preventing access to other information of public interest.
Another point she highlights is that not all categories of documents contained in authorisation proceedings should receive the same legal treatment. According to Maria Elisa, “it is neither possible nor legally sound to treat articles of incorporation, compliance reports, anti-money laundering policies and shareholders’ personal documents as though they were all equivalent for secrecy purposes”. In her view, information such as technical certifications, compliance frameworks, anti-money laundering policies and the identification of ultimate beneficial owners carries significant public and regulatory interest.
The specialist also argues that the discussion should not be reduced to a choice between transparency and privacy. As she states, “personal data protection and administrative transparency are not antinomies; they are principles that coexist through anonymisation techniques, restricted access for qualified categories of interested parties and selective disclosure”. In other words, personal data protection and regulatory transparency are not incompatible concepts, but objectives that can coexist when the mechanisms provided for in the legislation are properly applied.
This article was first published on the Portuguese SiGMA News page on 8 June 2026.
In Mexico City, from September 1st to 3rd, 2026, North America meets Latin America. SiGMA North America welcomes 4,000 participants for three days of business, insights, and inspiration for startups. Real insights. Real business. Reserve your spot.
