The European Union’s General Data Protection Regulation, which officially went on the books May 25, has had companies around the world worried—and for good reason.

Failure to comply with the data privacy and security regulation, which is applicable to companies that handle and process EU citizens’ data, could lead to fines of up to 4 percent of a company’s global revenue or 20 million euros, whichever is higher.