...
A data processing agreement must be concluded with all partners who process the personal data of the data subjects for research purposes (see 1.4). Such agreements are generally concluded with legal persons (e.g., partner universities, research institutions, or service providers), but, depending on the circumstances, they may also be concluded with natural persons (e.g., students, sole proprietors, or professional experts). The university’s data protection specialists can assist in determining data processing roles and in drafting or reviewing draft agreements. The university’s intellectual property lawyer can help with questions related to intellectual property in research.
2.3.1. Concluding data processing agreements with legal persons
If the university is the data controller in the research (see 1.4), it is first necessary to establish the partner’s role in the processing of personal data, as the roles determine the mandatory terms of the data processing agreement. The conditions for personal data processing may also be specified in the research consortium agreement, cooperation agreement, service agreement, or other main agreement regarding the research. The data processing agreement may be an annex to the main agreement or, if there is no main agreement, concluded as a separate agreement.
...
If the university is the processor in the research (see 1.4), the controller is responsible for concluding the data processing agreement and setting its terms and conditions and usually prepares the draft agreement.
2.3.2. Concluding data processing agreements with natural persons
If a data processing agreement is to be concluded with a natural person (e.g., an analyst or specialist), it must first be established whether they are acting as a representative of an institution or a company within the scope of their respective tasks or as a private individual providing services. If the natural person has access to the personal data and/or data processing tools in the course of their tasks within an institution, they must not use those data and/or tools to provide services as a natural person, in line with the principle of purpose limitation.
...
- a doctoral researcher employed as a junior research fellow processes data for preparing their doctoral thesis. Since a junior research fellow is a university employee, the purpose is university research, and the controller is the university. Personal data protection requirements arise from the employment contract concluded with the university and from internal rules; a data processing agreement is not required.
2.3.3. Agreements with partners in third countries
If research data are shared with partners outside the European Economic Area (EEA) – for example in EU-funded programmes (Horizon Europe, etc.), international consortia or multilateral international cooperation – it is necessary to consider international data transfer requirements already at the planning stage, and to assess which technical and organisational measures are required to comply with them, and whether the transfer takes place in the role of a controller or a processor. This determines:
...