First, the company decides whether the request needs to be complied with or not, and if the user doesn't like that decision, they can complain to the regulators

First, the company decides whether the request needs to be complied with or not, and if the user doesn't like that decision, they can complain to the regulators who may choose whether the refusal is worth looking into.