The GDPR permits the ICO to investigate and prosecute organisations which fail to comply.
For the most serious of breaches - fines of up to €20 Million or up to 4% of global turnover - whichever is highest, can be imposed
For less serious breaches - fines of up to €10 Million or up to 2% of global turnover - again, whichever is highest, can be imposed
Furthermore, the reputational damage is likely to be destructive and long-lasting.
There is already recent case authority to show how serious the consequences of a breach of data protection laws could be for businesses as in the Morrisons' case, click here for more information.