When your personal information has not been acquired directly from you but from Yet another supply, it's essential to acquire exactly the same data as earlier mentioned (besides the right to withdraw your consent). The eu Info Security Board offers guidelines on the application in the GDPR. Info protection authorities https://nathanlabsadvisory.com/iso-27701-privacy-information-management-system-pims/