The agreement should address privacy concerns, including any legal obligations to protect personal data and any restrictions on how the data can be used.