Consortium agreement (GDPR art. 26) — DRAFT

What this agreement is meant to cover

When several organizations run the same project as a consortium and share common personal data (beneficiaries, staff, suppliers) through the Futuh Hub, GDPR art. 26 requires them to agree, transparently, on how they split their obligations as joint controllers. This agreement will capture that essence.

Parties

The member organizations of the consortium that agree to share the execution of a specific project (the lead organization and its partners), as joint controllers.
Asamblea de Cooperación Por la Paz, as the entity operating the Futuh Hub and processing the data on behalf of the parties under the terms the agreement will set.

Split of obligations (in broad strokes)

Each member is responsible for the lawfulness of the data it reveals to the consortium. Revealing personal data in clear is decided and carried out always at the origin organization, imputation by imputation and with a declared purpose (funder justification or audit); by default, execution travels pseudonymized.
Whoever accesses revealed data may use it only for the declared purpose; any secondary use is excluded. The definitive text will additionally restrict the audience of the reveal to whoever needs it for that purpose (the lead organization justifying to the funder and, where applicable, the audit); in the current version of the platform the revealed data is visible to every member that has accepted the agreement, and that audience restriction is declared as a committed evolution.
The Hub applies common technical measures: pseudonymization by default, an access log with the disclosure events (execution pushes, downloads, acceptances, purges), readable by any member of the consortium (symmetric transparency), and a bounded retention of the execution data after which it is purged.
The default retention is 4 years from the closure of the share — aligned with the reimbursement limitation period of art. 39 of Spanish Law 38/2003 on Subsidies — and works as a floor, not a ceiling: conservation follows in any case the period required by the rules of the project’s funder (EU funds and regulatory bases may require longer periods, and the legal clock runs from the end of the justification deadline, not from the technical closure). The obligation to keep supporting documents «for as long as they may be subject to verification and control» (art. 14.1.g of the same law) is covered by the legal-obligation extension (legal_hold).
The exercise of data subjects’ rights and the handling of incidents and breaches will be coordinated between the parties as detailed in the final text.

Contact point

For any data-protection matter regarding the federation and the consortium: [email protected].