GDPR violations are so ubiquitous that regulators can't possibly go after all of them.
As long as you aren't a particularly juicy target and are doing the same things that everyone else is to pretend to follow GDPR, you probably aren't going to be among the first enforcement targets.