Depends on the site, the data involved, your jurisdiction, their jurisdiction, etc.

In the EU, you might be able to report it to a regulator. In Russia, perhaps not.