The General Data Protection Regulation (GDPR) came into force in mid-2018. Enforcement has varied between countries, with France applying the biggest fine of 50 million euros against Google.
The fines, which can reach as high as 2%, or sometimes 4% of global revenue, will probably rise as litigation sets legal precedent.