In Spain the fines are like 60k for data protection violations, no matter how small you are, and if you’re self employed, you can’t declare bankruptcy and you have to pay the fine with your own personal assets.
Perfect recipe to discourage individuals from innovating. I'm all for holding actual companies with user bases and counsel and insurance and a business model and etc accountable. But "private party just getting started with a bespoke solution was a bit careless or ignorant; luckily no serious harm was caused" should never be financially ruinous.