Companies panicking about the high fines associated with the European Union's recently implemented General Data Protection Regulation may want to think twice.

At least, that's according to a group of business and technology experts that gathered in Philadelphia on Wednesday for the 2018 NetDiligence Cyber Risk Summit. These experts seemed fairly sure that there has been too much of a focus on the fines behind GDPR.

The GDPR took effect on May 25 and carries penalties for noncompliance that can be as high as 4 percent of the offending company's revenue from the previous year or 20 million euros—whichever is higher.

The regulation requires companies to beef up the security of their networks that process the personal information of EU citizens and requires covered companies to notify the public of a breach within 72 hours of discovering it, among other obligations.

“I think that there will be some headline-grabbing fines, but I think they'll be the outlier,” said Oliver Brew, the head of client services at CyberCube.

Jason Glasgow, the vice president of the E&O division at Allied World, said he hopes and believes that the regulators will not be doling out multimillion euro fines on a regular basis.

“I don't think it will be a frequency issue,” Glasgow said.

Glasgow said he hopes that the regulators find ways to guide companies into staying compliant rather than hitting every company with a big fine—but said that it'll be hard to know how the EU data protection authorities will enforce the law until more actions have been taken.

Michael Bruemmer, the vice president of consumer protection at Experian Consumer Services, said he wouldn't expect to see major fines announced every week because the data protection authorities are short-staffed and underfunded.

According to the results of a Reuters survey released just weeks before the May 25 deadline, a majority of the GDPR regulators indicated that they themselves would not be ready for GDPR.

“The DPAs are understaffed. They don't have enough people to even do the basic stuff like investigations,” Bruemmer said.

Citing the Dixons Carphone data breach, which was announced on Tuesday evening, Bruemmer said companies should not be worried about alerting the public about the data breach within the required 72 hours.

“The way the GDPR is set up in terms of just breach notifications, it's much easier to notify people very quickly following the 72-hour announcement to the data protection authority,” Bruemmer said.