My point is that you won't be sued for the GDPR. What might happen is that a complaint is raised with the regulatory body. This is not the same thing as being sued.