It happens quite often that when running a business, you share personal data of your customers, counterparties or colleagues with other entities as part of outsourcing. When a third party uses personal data which they did not collect on their own, they should have a basis for such use.