By looking through the comments it seems many seem to think that smallest GDPR violation will immidiately see 20M fine. Isn't it the last method if previous methods are ignored like giving a warning, smaller fines etc.

So you don't have to do every single perfectly, just that you the basics done properly and your filling to fix things as they are shown to be broken. Well, unless your broken system leaks millions of users data into the wild I'd guess you're pretty safe.