While the GDPR allows for third party litigation, the violations are expected to be handled though relevant data protection authorities, and direct litigation i

While the GDPR allows for third party litigation, the violations are expected to be handled though relevant data protection authorities, and direct litigation is a last recourse if all else fails. If you haven't tried and failed to resolve your GDPR complaint through the relevant authorities, you'll be laughed out of the court, if you try to bring a GDPR case to it. Edit: any replies instead of just downvotes? Yes, it isn't spelled out entirely in the GDPR but it isn't operating in an empty place. The civil law systems of most of EU have certain assumptions in place, like that you will first try to find recourse through proper avenues, and only then try direct litigation. If anything, you might actually try to sue the data protection authority for mishandling your case.