Based on a discussion with a friend who is university professor in Switzerland (which is not EU member): The professor's institute ("Research Lab", part of the engineering department) is regularly doing research projects with institutions inside the EU (typical advanced engineering work like design of complex electronics). These institutions are companies and also other universities.
The professor's institute keeps contact information of a number of students and/or engineers from these EU institutions, which it must do to do the work, and this is private data which is GDPR-relevant (to my understanding).
The university has a link to the university's privacy policy where they point out that they are GDPR compliant, and give an address for getting more details about their policy (no link, just email and postal address). Just one very short paragraph, that's it. The professor's institute webpage uses the link to this privacy policy per default.
Does GDPR apply to the scenario as described? If yes, who is responsible for fulfilling GDPR? The university or the professor?