If researchers are obtaining personal data from a third party, they should seek assurances about the information in accordance with the University’s obligations.
It is important to note that if you are relying on the consent of the individuals to process any personal data, you will need to see those consents – third-party assurances alone will not be sufficient, although the ICO may take them into account in any enforcement action.