Their contract will set out what they are permitted to do with personal data.
Bydd eu contract yn nodi'r hyn y caniateir iddynt ei wneud gyda data personol.