Joint controllers

What it means

Joint controllers are two or more organisations that together determine the purposes and means of processing personal data. Typical examples are group companies sharing a customer database or partners who jointly run an event and collect participants' details.

The concept comes from the GDPR and differs from the relationship between a controller and a processor. A processor handles data only on instructions, whereas a joint controller has its own influence over why and how the data is processed.

Joint control does not require an equal share in decisions. It is enough that each party influences at least part of the processing for its own aims, for example when a company embeds a third-party tool on its website that also collects visitor data for the tool's provider.

How it works in practice

Joint controllers must have an arrangement between them that sets out who meets the information duty, who handles requests from data subjects, who deals with security incidents and who communicates with the supervisory authority. The essence of the arrangement must be made available to data subjects.

In practice the arrangement is often attached to a framework agreement between group companies or to a cooperation agreement for a joint project. Joint processing should also be entered in each party's records of processing activities so it is clear which operations each one is responsible for.

If an outside supplier is involved, such as a CRM provider or an accounting firm, it must be clear whether it acts as processor for one of the controllers or for all of them. Data processing agreements and instructions are then set up accordingly.

What to watch out for

The arrangement between controllers does not limit the data subject's rights. They may turn to any of the controllers, and each can be liable for the full damage, although it may later claim a share from its partner. The allocation of duties is therefore mainly an internal matter between the companies.

In an inspection by the Office for Personal Data Protection, the actual situation counts, not the title of the contract. If a company claims to be a processor but in fact decides on the purposes of processing, the authority may treat it as a joint controller with all the duties that entails.