While the GDPR allows for third party litigation, the violations are expected to be handled though relevant data protection authorities, and direct litigation is a last recourse if all else fails. If you haven't tried and failed to resolve your GDPR complaint through the relevant authorities, you'll be laughed out of the court, if you try to bring a GDPR case to it.

Edit: any replies instead of just downvotes? Yes, it isn't spelled out entirely in the GDPR but it isn't operating in an empty place. The civil law systems of most of EU have certain assumptions in place, like that you will first try to find recourse through proper avenues, and only then try direct litigation. If anything, you might actually try to sue the data protection authority for mishandling your case.

I'll try to answer. The law doesn't actually say that you can sue only after complaint resolution through authorities have failed. That is merely expected practice and assumptions. Potentially facing a frivolous lawsuit in Europe is high risk for a business which small businesses may not want to take. If that's the intent, it should be codified in law.

Even if true, how are small American companies supposed to know about any of that without investing in a lot in European lawyers? Easier to just not serve the market.