It’s reminder for you’re team (and you’re DPO first). You must comply to GDPR, and write you are GDPR compliant in you’re website is not enought.
When someone ask to have access to personal data you store you have 2 month to answer … or said " we have to many work so it will take 1 more month".
Not 2 years.
I have make an 2 official request for my data and they don’t receive answer : The first during blackout. The second on december and directly to you’re DPO.
So i notify you here i will ask the CNIL to open enquest on you’re compliance to GDPR. I hope you will answer so i could stop the legal procedure to have an access to my personal data.
After the period of time has elapsed you can escelate with your data ombudsman (there should be a list of them for every country), even if you believe it has not been resolved to your satisfaction if it is within their remit.
In fact if you read i launch a procedure with the CNIL who is the french part of state who manage this kind of thing. (yes i haven’t got precision of what CNIL is on my first message)