On May 25, 2018, the European Union’s General Data Protection Regulation (GDPR) went into effect.

During the two-year preparation phase, after the bill was passed in April 2016, legal observers wondered how severely data commissioners would enforce the law. A little over a year and a half later, GDPR fines are rolling out, and it appears regulators aren’t shy about penalizing companies they find at fault.