Definitely. Here is an example: https://www.insideprivacy.com/data-privacy/portuguese-hospit.... There are also many, many more examples for smaller companies that get fined 5000-20000.