The EU doesn’t enforce the GDPR, it’s the member states (or more specifically, the member state where the controller has their main establishment). However, individuals can also sue controllers directly.