If an organisation fails to comply with statutory regulations such as data protection laws, it may be required to pay fines or damages.