Guidelines 07/2020 on the concepts of controller and processor in the GDPR

Section 2.2  Allocation of responsibilities needs to be done by way of an arrangement