Both, if I understood what you mean: The GDPR regulation ((EU) 2016/679) contains provisions for legal enforcement, and describes which process and agencies are responsible for that.

Whether this actually works, only time can tell. But the fact that similar previous legislations went unenforced was a specific concern that the designers of the GDPR intended to address.