there is usually annual report by some law firms talking about the state of GDPR, and so far the EU or states hasn't been keen on charging high fines as the law

there is usually annual report by some law firms talking about the state of GDPR, and so far the EU or states hasn't been keen on charging high fines as the law suggest instead closer to slap on the wrist kind of fines for transgressions that sounds big when you read the law. I think most corps by now realize that and are willing to live with the risk rather than lose a lot of data and introduce a lot of processes.