The reality is that the 2% or 4% figure depends on which part of the GDPR you have breached and isn't a tiered approach. Breaches of core requirements (for exam

The reality is that the 2% or 4% figure depends on which part of the GDPR you have breached and isn't a tiered approach. Breaches of core requirements (for example valid processing grounds) will attract a 4% fine straightaway technically speaking. Art 83 covers the different triggers. Having said that there are various schools of thought around levels of potential fines, including from different data protection authorities in the EU. Considering the ICO in the UK is yet to levy a maximum fine despite egregious violations is at least one factor to suggest fines will not increase dramatically. Also there are not only increased fines to consider but an increased focus on compensation to data subjects in the event of a violation of their rights (together with an evolving case law to support that in the UK at least).