Article 19 et al., here.
Activating the full DMA's potential (Episode XX, still only scratching the surface):
"Article 27
Information by third parties
1. Any third party, including business users, competitors or end-users of the core platform services listed in the designation decision pursuant to Article 3(9), as well as their representatives, may inform the national competent authority of the Member State, enforcing the rules referred to in Article 1(6), or the Commission directly, about any practice or behaviour by gatekeepers that falls within the scope of this Regulation."
But (and this is one of the issues with the DMA, not the it wasn't mentioned during the negotiations):
"2.
The...Commission shall have full discretion as regards the appropriate
measures and are under no obligation to follow-up on the information received"
