It doesn't, at least not under GDPR and not in that scenario. Contoso is a "[personal] data controller" and SAP is a "data processor". Contoso has a legal responsibility for all personal data and for all its vendors.

Contrary to a popular opinion, GDPR is fairly logical and close to common sense.

It gets murkier with "joint data processing" (a cursed cop-out for scenarios like Facebook acting both as a data processor for a website's ad tracking and as a data controller for its own ad tracking at the same time), but the scenario you described is not that.