Well that's clearly false. GDPR fines for data breach (when there is enough negliglence) (or even inproper handling of data breach) can be pretty severe. At least in theory, in practice the enforcement depends on the country and the fines are usually nowhere near the legal limit. But there is a penalty.