The lesson from Europe is clear: Companies that willfully neglect their obligations under PDPL, or that engage in egregious breaches of individuals’ privacy rights, can reasonably expect that SDAIA will—eventually and decisively—exercise its full enforcement powers.