GDPR does not explicitly prohibit this; however, you are required to inform the data subject about this fact and disclose the source from which their data was obtained. The data subject then retains their rights under GDPR — the right to erasure, etc.
Marketing Contact Database from a GDPR Perspective
Is It Possible to Purchase a Database of Individual Contacts for Marketing Purposes?
Written by Petr Pech