[nspady]

It is the whichever is greater of 20 million Euros or 4 percent of annual turnover.

[solarkraft]

I see. That must seem brutal to small businesses.

[kungtotte]

There's also the proportionality clauses to consider. The law explicitly states that the penalty should be proportionate, so that small companies aren't hit with huge fines.

[toomanybeersies]

The fines are supposed to be proportional. Everyone has latched on to the $40mm clause, and decided that anyone in breach of GDPR rules is going to be fined millions of dollars.