I don’t know if that list is exhaustive. Besides, it’s only fines. I think everywhere I’ve worked has had requests (“what information do you hold on me and what

I don’t know if that list is exhaustive. Besides, it’s only fines. I think everywhere I’ve worked has had requests (“what information do you hold on me and what do you do with it?”) that haven’t resulted in any punitive action. I’m not completely sure what you meant by investigations but I’m just trying to point out that GDPR certainly isn’t toothless.