Violation and breach of the General Data Protection Regulation can lead to the imposition of sanctions, including administrative fines, for any type of company, from multinationals to micro-companies. There are two levels of fines in the GDPR:
Less serious violations could result in a fine of up to €10 million or 2% of the company's worldwide annual revenue from the previous fiscal year, whichever is greater.
The most serious violations can result in a fine of up to €20 million, or 4% of the company's worldwide annual revenue from the previous fiscal year, whichever is greater.