Comment by SpicyLemonZest

It should, and that SOP is essentially always going to say something like "file a tracking ticket and immediately forward to legal for all further conversation". It sounds like the author really was just trying to be a helpful guy, but the typical person who emails a company about "multiple GDPR violations" is absolutely trying to get them in trouble, and a random developer with no comms training risks putting their foot in their mouth in legally consequential ways.