Do consider that they can also shut down whatever operations they consider to be in violation. For example, if you're in e-commerce like my previous employer,

Do consider that they can also shut down whatever operations they consider to be in violation. For example, if you're in e-commerce like my previous employer, then having your website/app channels shut down while you implement some bizarre scheme can cost you even more than 4% of your annual revenue. For a big, established company with byzantine operations and large code bases, being caught entirely unprepared can mean a mountain of effort - months - to become compliant. (And I haven't checked but I imagine it's past year's revenue that is used for the calculation so the double whammy doesn't even get reduced by being shut down.)