First, does the agreement involve the transfer of personal data from one party to another, or is the data transferred in both directions? There are two legal mechanisms for clarifying roles, responsibilities and expectations in data transfer with a third party: contracts/data processing contracts – an obligation for the subcontractor to delete all personal data or return it to the processing manager, as requested at the end of the contract. The safety of treatment must be guaranteed in accordance with Article 32 of the RGPD. Within Durham University, contracts and data exchange agreements are prepared by the legal services team after receiving instructions from the budget owner/owner of information objects and signed by one of our authorized signatories. In case 2.1, the subcontractor should be contractually required to pass the data on to the subcontractor at least at the end of the contract. There should also be an obligation to act solely on the instructions of the treatment manager, which at some point will be implemented as an obligation to act on the instruction of the person in charge of the treatment – although the subcontractor wants to see limits and qualifications for the instruction of the person in charge of the treatment. Finally, remember to take into account the effects of the law in the jurisdiction in which the data is transferred. In some cases, there may be an irreconcilable contradiction between EU law and applicable national law. Even if the RGPD does not impose specific obligations, it is important that a treatment manager recognizes the principle of responsibility. Compliance with data protection principles applies to data exchange practices as well as day-to-day processing. While the conditions are binding on the subcontractor, it is essential that the processing manager guarantees the existence of a written contract, since he is responsible for processing in accordance with the data protection rules. There are two parties involved in a data-sharing relationship: (a) only processes personal data on documented instructions from the processor, including the transfer of personal data to a third country or international organisation, unless necessary under EU or Member State law submitted to the subcontractor; in this case, the subcontractor informs the person in charge of the processing of this legal requirement prior to processing, unless that law prohibits this information for important public interest reasons; In any case, make sure you have documented in the context of your written recordings.