The glossary has been growing to clarify these terms. There is an article about the governance, which entities would have to agree to, to be allowed to handle personal data. That article was just created and is far from finished. Please help by adding best practice or even what you would desire - we can always edit it later 