Europe’s tough new data privacy law is so strict that it could kill off startups trying to operate in Europe, according to German software giant SAP in comments reported by The Financial Times.

Bernd Leukert, head of products and innovation at SAP, says the fines are steep enough to wipe out start-ups with a single violation.

Speaking to The Financial Times, Leukert said: “If you have 25 violations your entire revenue is gone.”

The EU overhauled its regulation of how companies collect and use customer data last April. The idea is to give consumers more control over their data and knowledge of how it’s being used. A key change is around consent – consumers now have to agree proactively to hand over their data. A pre-ticked box on a web form wouldn’t qualify as consent, for example.

Companies found to be violating the rules can be fined up to 4% of global revenues. The law will apply from 25 May next year.

For Leukert, the threat of huge fines will stymie the growth of startups in Europe.

“The more bureaucracy, the more complexity you have in your business segment, the harder it is to grow fast, and speed is what matters these days,” he is quoted as saying.

He added that EU laws needed to tally with laws in other jurisdictions. “We might have local regulations, but we need these issues solved on a global basis,” he said.