Breaching GDPR carries the risk of significant administrative fines. The size of a fine is assessed case by case, but the ceiling is 20 million euros or 4 percent of the company’s total global annual turnover, whichever is higher.