Scares them well enough and the "up to" won't kill a smaller business, provided the transgression wasn't too serious.
I had trainings upon trainings about this, particularly because in my line of work I deal with medical data, which is categorised as sensitive.