You have no idea what their financial situation is. Just because the government claims that it won't bankrupt them, doesn't mean that it won't. EU countries t

You have no idea what their financial situation is. Just because the government claims that it won't bankrupt them, doesn't mean that it won't. EU countries tend to have very high tax rates, and they don't seem to think that will have any impact on the well-being of their businesses and citizens either, so their judgment in such matters has been proven to be suspect at best. You also have absolutely no way of knowing if all countries will attempt to be benevolent data overlords, as Germany appears to have been in this case. My guess is that had this been an American company, the gloves would have come off. There are 28 unique countries subject to GDPR, and each will have their own interpretations and enforcement policies. The only thing that any smaller company knows for sure about GDPR is that they may be fined up to 20M EUR, regardless of their ability to pay. Other than that, both its requirements and its enforcement are entirely up in the air.