From the EU commission;

1. Contact your Data Protection Agency (DPA)
2. Legal action against the company
3. Legal action against your DPA

Source: https://commission.europa.eu/law/law-topic/data-protection/reform/rights-citizens/redress/what-should-i-do-if-i-think-my-personal-data-protection-rights-havent-been-respected_en