Definitely. Here is an example: https://www.insideprivacy.com/data-privacy/portuguese-hospital-receives-and-contests-400000-e-fine-for-gdpr-infringement/ https:

Definitely. Here is an example: https://www.insideprivacy.com/data-privacy/portuguese-hospital-receives-and-contests-400000-e-fine-for-gdpr-infringement/ https://www.insideprivacy.com/data-privacy/portuguese-hospit.... There are also many, many more examples for smaller companies that get fined 5000-20000.