What’s good to know that generally, in the EU and most European countries, I believe, the goal of regulations is compliance, not punishment. So “finding that an organisation is in breach” of something isn’t necessarily the first step towards punishment (fines or whatever) - often the next and final step is notifying the org and the org making adjustments to comply.