Did you work with personal data before DPA/GDPR?

If so, could you just give out anything that was asked for? For example, if someone requested personal information for someone else did you just hand it over without a second thought?