I still feel like unless there is a very significant increase in staffing, they are probably going to have to pick and choose the enforcement actions that they bring,

The data protection authorities have other tools as well, which might be even costlier than fines, Kagan said.In some cases, EU regulators can tell companies, “You have 90 days to rectify the thing you are doing wrong with the data, or after 90 days you cannot use the data.” Sometimes, even the big fines won’t make or break them, but the data will if it is a core component of their business.

Lest U.S. companies think they will escape GDPR because they are headquartered in the U.S., Milla believes there will be fines applied to companies in the EU, the US and other jurisdictions.