Real redress, in order

1. The controller, through its contact point

   Without waiting

   Reply to the warning email from the address of the affected account. Ask for what the text requires: which data is affected, what the likely consequences are, what measures have been taken, and the contact details of the data protection officer. Keep every exchange: the content of those answers, or their absence, is what will feed the complaint.

   Data protection and online privacy (Your Europe, European Union)

2. The data protection authority of your country

   If the warning stays incomplete, or in case of doubt about the file

   The Regulation lets you choose between the Member State of your habitual residence, that of your place of work and that of the place of the alleged infringement. The official EU page states that the authority investigates the complaint and responds within three months. It is also the body that can require the company to send the individual warning it never sent. The European Data Protection Board publishes the list of all the national authorities, with their contact details.

   The national data protection authorities (European Data Protection Board)

3. The judicial remedy, without going through the authority

   At any time

   The official EU page states that you may take the matter straight to court, without first going through the national authority. For a low-value cross-border claim, the European Regulation that sets up the small claims procedure states in black and white that representation by a lawyer or another legal professional is not mandatory there.

   Small claims (e-Justice portal, European Union)

Limitation periods and the rules of procedure before a national court are not covered here: this site presents only the European baseline common to the twenty-seven.