GDPR Q37
What is a joint controllership arrangement?
Q37. What is a joint controllership arrangement?
Category: Roles
Joint controllership arises when two or more organisations decide together why and how personal data is processed.
In simple terms
- Joint controllers must transparently divide responsibilities.
- Individuals can exercise their rights against any joint controller.
- Formal agreements and clear notices are essential.
Identifying joint controllers
Joint controllers determine the purposes and means together. Look beyond contracts—focus on who actually makes decisions.
- Shared decision-making equals joint controllership, even if one party handles operations.
- If one party acts only on instructions, they are likely a processor instead.
- Joint controllers must comply with all applicable GDPR duties.
Allocating responsibilities
Create a transparent arrangement that covers privacy notices, rights requests, security, and breach reporting.
- Publish the essence of the arrangement for individuals.
- Ensure coordination for SARs and complaints.
- Review the arrangement regularly and when processing changes.
Practical steps to take
- Assess partnerships to determine if decisions are shared.
- Draft a joint controller agreement covering responsibilities and contact points.
- Update privacy notices to reflect joint control.
- Coordinate on DPIAs, breaches, and rights responses.
- Review agreements annually or when projects evolve.
Real-life examples
Joint event
Two organisations co-host a conference and jointly decide how attendee data will be used. They publish a joint privacy notice.
Shared recruitment portal
A group of employers run a shared recruitment platform and agree how candidate data is handled across the group.
Helpful reminders
- Individuals can sue any joint controller—clarity reduces disputes.
- Ensure processors understand who the controllers are.
- Keep records of meetings and decisions about shared processing.
Key takeaway
Joint controllership demands cooperation and transparency—set clear rules and keep them under review.
Article references
Further reading
Have we made a mistake, or an error or omission? Email support@akadata.ltd so we can correct it quickly.