Have you looked at a list of GDPR fines? The are small time people getting hit with ridiculous sums (not millions but still egregious).