One additional question?;

are you referring on to a case where you have not met the regulations (from the perspective of the information and options you give to your end-users) and authoritative entity comes to you with warning which you are not going to notice

-OR-

are you referring on to a case where personal user data is stored and used without end-user explicit consent and/or knowledge and/or that data "leakage" has caused/will probably cause in the future real damage to this user