Depends on the jurisdiction and the case specifics. In europe, under GDPR the consequence we (my employer) are the most terrified about is an injunction to stop any further processing of given data for a purpose that would be deemed illegitimate.

You’re not coming back from that one…

And that would typically be on top of the fine which would be to some extent « cost of doing business » indeed.