GDPR fines can be up to 4% of a company’s turnover (at group level too, not just the turnover of the local subsidiary). Whether the courts will actually use the maximum fine remains to be seen, but on paper it’s enough to give you pause - 4% of revenues is a large chunk of money for anyone. I work for a large EU company and this possibility is taken very seriously.