You're partially correct. Citizens can bring complaints before their local supervisory authority, but cross-border issues are dealt with first and foremost by t

You're partially correct. Citizens can bring complaints before their local supervisory authority, but cross-border issues are dealt with first and foremost by the lead supervisory authority. To wit, article 56(1) of the GDPR: >Without prejudice to Article 55, the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60. and 56(6): >The lead supervisory authority shall be the sole interlocutor of the controller or processor for the cross-border processing carried out by that controller or processor.