If the company has contact info for the user, it should send the user a notification via that contact info. Even if that means having to send a physical letter.
The company should also keep a public record of transfers, something like a page on their website listing when they've transferred data, why it was transferred, and what kind of data was transferred. That would cover anonymous users.
There would need to be something in there covering data transfer as part of what the company's business is. Maybe a list of businesses that access your data as part of the provided services and are covered by the company's terms?
Even better would be to force companies that make money selling your data to share the profits with every person they just sold data on.