Complain, shame or otherwise deal with companies that leak personal data

I use a unique email address whenever I signup for a service. Occasionally a service provider will (legally) forward the email address and a other data points to a third party on a need-to-know basis.

Since about I year I’m receiving spam / promotional email / phishing to such addresses from unrelated entities. This allows for two interpretations

• the original company sold my data; thus, violating GDPR
• the original company failed to keep the data secure, and did not notify the public / affected clients about breach; which also violates GDPR or other regulations.

I tried emailing some company that leaked my email and got a canned response, not understanding the issue.

If their is a government agency or NGO where I can file report regarding a likely data leak?