Agree on data access before connecting anything.
Name the systems involved, the data needed, who can see it, and what happens when the engagement ends. Review the data-processing agreement before work starts.
Put it into practiceWho can grant access, and who can revoke it?
