If you belong to some form of “circulating library” of personal data, less than one year from now you will encounter an excruciating dilemma. Under Article 14 of the GDPR you must notify the data subjects, whose data you have just received, of that fact and of your intentions with regard to the data. If you fail to do that you will be in breach of the Regulation. If you do it, the data subjects may direct you to delete it. If there is no legal basis for your possession of the personal data in the first place it is very likely that the data subject will report you to the regulator.
What is necessary to know is this; personal data will require to be accompanied by its “title deeds”. The ownership or right to possession of personal data, and the right of transfer, must be proved.
Possession of personal data will not be cheap. Receiving it might prove to be very expensive.