Regulatory penalties for non-compliance with GDPR include damages incurred by the data subject, supervisory authority’s administrative fines, and possibly reprimands. Legal obligations for non-compliance with the EU’s General Data Protection Regulation can be substantial amounts.  Data subjects can seek compensation from the data controller(s) or data processor(s) if they incur material or non-material damages connected with GDPR. To be liable for damages, the data controllers or data processors must cause the event. Supervisory authorities can impose penalties, including administrative fines for infringements of specific provisions of the GDPR privacy law and non-compliance with a supervisory authority’s order, according to Article 83. The administrative fines are “up to 20 million EUR, or in the case of an undertaking, up to 4% of the total worldwide annual turnover [sales] of the preceding financial year, whichever is higher.”  For minor infringements of GDPR or if it would result in a “disproportionate burden to a natural person,” a reprimand may be issued instead of an administrative fine.