The term Data Protection Authorities (DPAs) can be misleading. After all, it is not the data that is protected by the DPAs, but the human behind the data. Arguably, however, in data protection enforcement, the DPA’s attention is focused on legal acts, procedures, and cases, often at the expense of the complainant, who is left without an effective remedy for years. Shifting the focus of enforcement back to the individual is therefore a proposition increasingly raised by activists and one of the main objectives of the European Data Protection Supervisor’s Strategy 2020-2024. Since such a human-centred approach characterises the consumer protection authorities, there is a growing realisation of the important role that these authorities (may) play in the implementation of data protection.