The UK’s new GDPR and DPA 2018 set a maximum fine of £17.5 million or 4% on annual global turnover – whichever is greater – for the most serious infringements, which are now subject to criminal penalties such as imprisonment.