Non-compliance with GDPR may lead to fines for both large and small businesses. The amount of the GDPR fine is dependent on many factors. It will for instance make a difference if non-compliance was deliberate or due to negligence and how well your business cooperates with the authorities. The upper limits of GDPR penalties are:
Up to £8.7 million or 2% of annual global turnover (whichever is higher) for less serious infringements. And fines of up to £17.5 million or 4% of annual global turnover for severe infringements.
In addition to these fines, companies may have pay compensation to affected persons.