Scope
The parties should define the data involved, processing purpose, retention period and authorized users in the applicable project or service agreement.
Security
Reasonable technical and organizational safeguards should be used to protect personal and operational data against unauthorized access, loss or misuse.
International transfers
Where cross-border transfers apply, the parties should use the contractual and legal safeguards required by the relevant jurisdiction.