Under GDPR, the data subject has the right to request all personal data a data controller has on them. This includes their supply chain.