Here you go: https://www.eugdpr.org/key-changes.html https://www.eugdpr.org/key-changes.html "Under GDPR organizations in breach of GDPR can be fined up to 4%

Here you go: https://www.eugdpr.org/key-changes.html https://www.eugdpr.org/key-changes.html "Under GDPR organizations in breach of GDPR can be fined up to 4% of annual global turnover or €20 Million (whichever is greater). This is the maximum fine that can be imposed for the most serious infringements e.g.not having sufficient customer consent to process data or violating the core of Privacy by Design concepts." So that 20mil or 4% (whichever is greater) is for companies that have seriously violated the GDPR. It remains to be seen how it is enforced, but my understanding is that this is purposely designed to be very punitive to force companies to have a dollar amount in mind when it comes to designing security and doing the right thing.