When using Google Analytics and receiving a GDPR subject access request does the party receiving the request also have to send all data collected by Google Analytics?
Yes, it would be too obvious a loophole otherwise. You'd just put a shell company in front of the actual business, and have that shell company claim it didn't hold onto any data.
Formally, you are the Data Controller, and Google is a Data Processor. You must have a contract in place with Google that guarantees you can abide by GDPR obligations.
Just to add to the (correct) answer already given by @MSalters.
You can escape this obligation by not letting Google Analytics process personal data on your behalf.
You can do this by enabling the GA IP-anonymization feature.
If you use Google Analytics and do not use this feature, you need to have a DPA (Data Processing Addendum) contract in place with Google in order to comply with the GDPR.
This is a real hassle, so unless you absolutely need fine-grained demographic data, it is strongly recommended that you use IP-anonymization. According to our data protection supervisory authority, this is sufficient to comply with the GDPR vis-a-vis Google Analytics.