A company transfers data processing to a supplier but retains legal accountability for the records. What should treatment include?

1. Contractual duties, assurance, monitoring, and retained-risk governance
2. A statement that the supplier owns every legal consequence
3. Only a lower processing price
4. Removal of all internal data ownership