The first is correct. The second one is correct, though I would leave out the comma. The third is not correct.
in the first example (1), you have a simple direct question, in which case the word order is forced - as you probably know, English has an "obligatory beginning of the sentence" rule for interrogative statements such as this.
It would be incorrect to say "The source of the data is what?", though it is sometimes spoken that way in response to an initial question, with emphasis - but this is idiomatic E.g.:
- person 1: "I just found out the data comes from a spy plane flying over Pakistan."
- Person 2: "The source of our data is what?.
In your second example, "what" is actually not a question - it's a subordinate clause (sometimes called interrogative content clauses) - it is certainly confusing, but if you think of it in terms of "wo" or "was" in the same way German uses it, then the verb at the end of the subordinate clause will feel natural - and it's correct.
Just one more example, in case you're interested:
He wanted to know what the source of the data was.
This is an example of an "indirect question" - note the verb at the end. Same structure as your second sentence, but with the intent of reporting a question that was asked.
I'm not a grammar expert, just a native speaker, so hopefully that helps.