(10)Each joint controller should remain individually responsible for maintaining a record of the processing activities that fall under its responsibility; determining the periods for which the personal data will be stored; deciding to restrict the application of data subject rights, where necessary and proportionate, or to apply any exceptions under Article 16(5) of Regulation (EU) 2018/1725 or Article 14(5) of Regulation (EU) 2016/679; identifying and assessing the lawfulness, necessity and proportionality of transfers of personal data to a third country or an international organisation; and engaging the processors which process personal data on its behalf.