.. eventually. You've got to go through your country's Information Commissioner.
In addition to that, most of the GDPR laws don't actually create a direct right of action. In many cases only the ICO is allowed to take action. And they may not bother.
Which is why the UK's Open Rights Group is taking the ICO to court to get them to enforce GDPR: https://www.openrightsgroup.org/press-releases/privacy-organ...
(I don't know where this 100 person number comes from?)