penalties will reach an upper limit of €20 million or 4% or annual global turnover – whichever is higher.
No, potential penalties will. But other UK and EU regulators have had 10% of turnover fines for years, few fines have ever come anywhere near the limit. Post GDPR, we can expect that fines will go up significantly. But I'll be amazed if the actual fines are anywhere near the potential maximum.