Failure to fulfil the obligation to report a data breach to the relevant supervisory authority is punishable by a fine of up to €10 million or, in the case of a company, up to a maximum of 2% of its annual worldwide revenue from the previous financial year.