When your own data hasn't been obtained straight from you but from One more resource, you have to receive a similar facts as earlier mentioned (other than the correct to withdraw your consent). Read about the legal rights you've over your own details under the GDPR, how to workout these https://nathanlabsadvisory.com/nist-800-171/