That's not how the GDPR works. Just like criminal procedure, subjects do not sue alleged offenders themselves. The state instead sues on their behalf.