The management and executives are liable. Data protection officers and employees are only liable in cases of intent or gross negligence.