When relying on third parties to provide services, the EU institutions remain accountable for any data processing carried out on their behalf, they also have a duty to ensure that any contractual arrangements respect the new rules and to identify and mitigate any risks.