GDPR has a stated goal of harmonisation in general, and of penalties in particular. This article demonstrates that under GDPR penalties, and especially fines, are inconsistently applied across EU member states, and that GDPR has left many of the most important topics relating to fines to member state legislation. The article starts by showing that the One-Stop Shop mechanism actually incentivises forum-shopping. Next, it is shown that the method of calculating fines is inconsistent and unsettled. Different language versions of GDPR lead to different conclusions as to how to calculate an undertaking’s revenue, and the meaning of an undertaking is neither entirely consistent within GDPR itself, nor across member states. The role of regulators is likewise unclear, and in some member states the regulators do not even have the power to impose an administrative fine under GDPR. The role of non-regulators, such as data subjects and representatives of classes of data subjects similarly lacks consistency across member states. Public bodies are another area of disharmony between member states: the scope of applicability of GDPR to public bodies is a matter for member state legislation, and the outcomes are in fact different across member states. Additional areas discussed include: the responsibility and liability of directors and officers of a company; the enforceability of a contract for insurances against GDPR fines; choice of law clauses as governing data being processed under GDPR; and issuance of warnings prior to imposition of fines. In all these areas, GDPR itself and member state law is inconsistent and is far from harmonised. Finally, the role of the economic model of the infringing party in calculation of the applicable fine is unsettled, and is left to member states, and is therefore similarly at odds with a goal of harmonisation.