There are many different ways for GDPR to be effective without fines. In the UK, for example ICO aims to offer warnings and guidance in most cases. They aim to get people compliant, levying fines in cases of wilful contempt or egregious slackness. It’s not primarily a money making exercise