The GDPR affects not just companies that handle personal data but also their vendors and suppliers. Companies must make sure their whole supply chain follows GDPR rules. They can be blamed for their vendors' mistakes.