Up to €20 million, or 2 to 4% of the worldwide annual revenue of the prior financial year, whichever is higher, shall be issued for infringements of the regulation. The GDPR also allows individuals to file single lawsuits or group actions.