When your individual information hasn't been obtained directly from you but from A different source, you have to obtain a similar information as previously mentioned (apart from the right to withdraw your consent). The European Knowledge Security Board gives rules on the appliance from the GDPR. Data defense authorities developed https://nathanlabsadvisory.com/data-protection-officer-service-virtual-dpo/