Re: "ensure that non-EU suppliers cannot access the EU market on an equal footing"
"It is reasonable that it is not sold on for illegal purposes."
How about "given" or "handed over" rather than "sold"? Is it the monetary transaction that's important? Does the word "illegal" mean "against law in either my country or your country"? (Hope you lave multinational lawyers on staff.) Would it mean acceptance of liability if the data is used for illegal purposes (whether or not you had the ability, foresight, or power to guard against that)?
I'm guessing you mean, "if it's ok in my country, it should be ok for you regardless of whatever your local laws may say."
"Using the data to personalise a service (e.g. adverts) sounds reasonable. "
It might, IF I have explicitly agreed to that. (Personally, I don't want unsolicited adverts, in e-mail we call those "spam". And I want personalised adverts even less.)