Breaking privacy laws can result in fines of up to 4% of global revenue or 20 million, whichever higher.