It's in the text of the legislation. Chapter 7 sets out the requirements for the European Data Protection Board to ensure consistent application of the regulations across all member states.

Article 83 states that any penalties must be proportionate to the nature, gravity and duration of the infringement, the intentional or negligent character of the infringement, action taken to prevent or mitigate an infringement and the degree of cooperation with the supervisory authority.

https://gdpr-info.eu/

However there is a grand plan to do the absolute opposite, which is to adopt the entirety of EU law into UK law. The so called "Great Repeal Bill" or whatever they are calling it this week.