As an organisation, I want access policies on functions and data to be implemented by the organisation supplying a resource so that GDPR requirements can be satisfied.

[arnoudquanjer]

Resolved by implementing Data processing agreement register