Scares them well enough and the "up to" won't kill a smaller business, provided the transgression wasn't too serious.

I had trainings upon trainings about this, particularly because in my line of work I deal with medical data, which is categorised as sensitive.

I don’t think it scares the big players enough; they still violate it. I’ve also had trainings about it.

> Scares them well enough

Not enough not, you still get almost all market participants trying to skirt the law instead of actually respecting it.