General Data Protection Regulation has introduced a tiered approach to fines, meaning that the severity of the breach will determine the penalty. Within the GDPR, there are two ways how a penalty may be implemented against the company:
- Through the acts of the data subjects (natural persons)
- Through the acts of the supervisory agency.
Any person who has suffered material or non-material damage as a result of an infringement of this GDPR shall have the right to receive compensation from the controller or processor for the damage suffered (civil law claims).
Data subjects have the right to turn to the supervisory agency and lodge a complaint against a company, if they find that the company has used their data in a way, that is not compliant with the GDPR or the company does not fulfill the data subject’s rights (e.g.. right to be forgotten). 
This will provoke the supervisory agency to investigate the company and if they find, that the company infringes the GDPR, they may fine the company. Estonian supervisory agencies have said, that taking account the severity of the infringement and the actions of the company, they will give firstly a formal notice and if the company will not change its policies, they will give a monetary fine. Of course, if the infringement is in a large scale, they will fine the company immediately and may impose other restrictions on the company, such as a ban on processing.
Furthermore, supervisory agencies may fine a company if they have not followed the GDPR rules.
