It is the data controller’s responsibility to ensure their company is compliant with applicable data protection law. So in general, the company itself is responsible to ensure compliance. However, every country has specific supervisory authorities which may conduct periodic checks and investigations in cases of suspected violation of privacy laws.