People can sue (Article 79) and claim compensation for actual damages suffered (Article 82) due to a violation of the GDPR.

Administrative fines levied by a supervisory authority generally don't go to people who have had their personal data processed illegally, though.