As the DPA indeed doesn't function for these kinds of cases, it's also possible to involve the courts and get a legal remedy (i.e. sue them). In The Netherlands that's possible with a 'complaint procedure' in the case of GDPR rights, which is more forgiving on the process (it starts with a not-too-formal letter to the court instead of a summons) and allows for representing yourself. Maximum costs would be somewhere around € 2500 if you lose, € 0 if you win (disregarding all the work and effort that cannot be recouped).

Of course this really isn't something you'd want to do for these kinds of simple cases. But threatening to do so often goes pretty far. The court in the country of the data subject has jurisdiction, so any company operating from another country would need to defend themselves abroad, which can be a strong incentive to cooperate or settle the case.

I've gotten results for GPDR article 20 requests (data portability) multiple times after some strongly worded letters (Spotify [1], NLZiet, AliveCor and Albert Heijn), and have gone to court twice. Once won against Eneco (although that was only about court fees they didn't want to pay without an NDA), and once didn't lose but regrettably didn't win on a quite complicated case against ABN AMRO in which the court just didn't understand what machine readable means despite the clear guidelines by the EDPD.

[1] https://news.ycombinator.com/item?id=24764371