On the 12th of December I made a GDPR request to a major online retailer in the UK.
While there was a minor email exchange with a chatbot to confirm the request, I neither received the requested data nor a notice that it will take longer than 30 days to process the request. I only received an email on January 11 saying that the request is now being processed.
From my understanding, the company has 30 days to comply with the request or, with good reason, inform me that it will take longer (reference).
Did the company violate the GDPR, and if yes, is there anything I can do about it?