Just a minor correction:

Fins for violating GDPR can be up to 4% of a company’s total revenues or 20 million Euros, whichever is higher.