Organizations
can be fined upto 4% of their annual global turnover, or 20 million
euros (whichever is higher), for the most serious data breaches or
infringements, including not having sufficient customer consent to
process data or violating the core of Privacy by Design concepts.
They
could be fined 2% of their annual global turnover, or 10 million euros
(whichever is higher), for not having their records in order, not
notifying the supervisory authority and customer about a breach, or not
properly conducting an LIA.