When Your own details has not been acquired straight from you but from A further resource, you need to acquire exactly the same data as above (aside from the correct to withdraw your consent). The eu Data Safety Board offers rules on the applying of your GDPR. Facts safety authorities https://nathanlabsadvisory.com/key-components-of-a-successful-incident-response-strategy/