... well, you set up a LTD precisely to limit liabilities in that catastrophic case scenario but you'd probably find that people "coming after you" will be prop

... well, you set up a LTD precisely to limit liabilities in that catastrophic case scenario but you'd probably find that people "coming after you" will be proportionate to how much you have to come after ... I.e. if you're a guy with a side project that makes no money; you're unlikely to attract "parasitic lawyers". Further, in my opinion the GDPR is wholesome. You ought to implement it even if it didn't exist. If your business relies on playing fast and lose with user data then IMO it's not an honest business ... Further still, the worse punishment is 4%/20M; it's not the default intervention or anywhere near the only way that the GDPR will be enforced.