Who is responsible for fulfilling GDPR in university projects with EU-based industry partners - the university or the professor?

Question

Based on a discussion with a friend who is university professor in Switzerland (which is not EU member): The professor's institute ("Research Lab", part of the engineering department) is regularly doing research projects with institutions inside the EU (typical advanced engineering work like design of complex electronics). These institutions are companies and also other universities.

The professor's institute keeps contact information of a number of students and/or engineers from these EU institutions, which it must do to do the work, and this is private data which is GDPR-relevant (to my understanding).

The university has a link to the university's privacy policy where they point out that they are GDPR compliant, and give an address for getting more details about their policy (no link, just email and postal address). Just one very short paragraph, that's it. The professor's institute webpage uses the link to this privacy policy per default.

Does GDPR apply to the scenario as described? If yes, who is responsible for fulfilling GDPR? The university or the professor?

Answer 1

The GDPR (probably) doesn't apply

The territorial scope of the law is spelled out in Article 3:

2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

Neither the University nor the Professor appears to be engaged in "offering of goods or services" nor "monitoring of their behaviour".