What is the procedure when you become aware that data that has been collected and processed is in the possession of a third party?

The GDPR has very clear measures for these cases. There are deadlines for informing the Data Protection Supervisor, who must inform the National Data Protection Commission within 72 hours of becoming aware that the data has been compromised. If the breach could significantly affect the data subject, it may be necessary to inform them.