Companies will face fines of €15mn or 2.5% of turnover if they do not comply with cyber security requirements