Comment by erik_seaberg

> as long as you do your best to stop the bad thing, limit the breach, notify users, and be a good steward for their data, then it's all good

If that regulator happens to like you. There is no schedule of offenses and penalties and due process, only an absurdly high maximum for selective enforcement.