Absolutely, that's the harsh reality is that the companies that you are giving your data to aren't looking after them like you would expect. They use third parties which they define in their terms of services, but those third parties might not even have any policies set out to protect your data. Then, I have no doubt that some companies are also breaking their own terms of service, and it would be hard to prove.

In the modern times, we give up our data super easily, and being able to track who is selling it on can sometimes be difficult. One tip that I've seen mentioned is to sign up to websites that handle your personal data, is just to use a throwaway email. Although, most of us don't check these throwaway emails, and that means you might miss something important, so personally I would recommend signing up to services with youremail+theircompany@domain.com that way if your data gets sold on, and you start to receive spam emails, then you know that at least some of your data has been sold on.

Obviously, if you are not required to give up your information, and there are alternatives which allow you to keep your data safe, then absolutely always pick those over anyone that you might not be sure. For example, those that don't legally require KYC.