1. Without prejudice to the obligations to which joint controllers are subject under Regulation (EU) 2018/1725, Regulation (EU) 2016/679, or national laws, each joint controller shall be responsible for the following:
determining the periods for which the personal data will be stored in accordance with applicable data protection law;
deciding to restrict the application of data subject rights, where necessary and proportionate, in accordance with applicable data protection rules, including internal rules adopted by a joint controller or national laws in compliance with Regulation (EU) 2018/1725 or Regulation (EU) 2016/679, respectively, or to apply any exceptions under Article 16(5) of Regulation (EU) 2018/1725 or Article 14(5) of Regulation (EU) 2016/679, respectively;
identifying and assessing the lawfulness, necessity and proportionality of transfers of personal data to a third country or an international organisation and complying with its obligations under Chapter V of Regulation (EU) 2018/1725 or Chapter V of Regulation (EU) 2016/679, respectively;
engaging only processors providing sufficient guarantees to implement appropriate technical and organisational measures, pursuant to Article 29 of Regulation (EU) 2018/1725 and Article 28 of Regulation (EU) 2016/679, respectively;
providing to the other joint controllers a list of processors engaged by that joint controller to process personal data in carrying out the supervisory tasks listed in Article 1(2).
2. The joint controllers shall notify each other of any relevant information relating to compliance with the obligations set out in paragraph 1, while having due regard to the applicable confidentiality regime.