The punishment rolls down to the architects designing the system, who risk getting fired. Ultimately, they are the ones who decide if something is compliant or

The punishment rolls down to the architects designing the system, who risk getting fired. Ultimately, they are the ones who decide if something is compliant or not. In my anecdotal experience;people in good rep tech companies take compliance requirements very, very seriously. While the punishment may not have a huge adverse affect on the company, it does on the people implementing said systems. Being the one in the middle of a GDPR/SOC2 compliance oopsie means you lose all upward mobility in said company and risk getting fired.