The cases that make the news with 100 million dollar fines to trillion dollar companies are just the ones in which the prosecution can't even reach someone at the company cause 100 million dollars is a drop in the bucket not worth looking at.
Most of the time, when somebody contacts you because of these issues, you have 30 days to comply, and if you discover that the problem is bigger than anticipated, these deadlines can be negotiated.
The point of the laws in the EU isn't to collect fines, but rather to make sure that everyone complies. You don't win much by going to trial and letting the other party explain why complying in 30 days is physically impossible.
So as long as the other party is willing to comply, the first attorney letter get things moving, and then the issue is resolved.