Managing Joint Controller Arrangements

Overview

Article 26 applies when two or more controllers jointly determine the purposes and means of processing. Joint controllers must enter into an arrangement that transparently determines their respective responsibilities for compliance, particularly regarding data subject rights and transparency obligations. The essence of the arrangement must be made available to data subjects.

Determining Joint Controllership

Joint controllership exists when two or more entities:

1. Jointly determine the purposes — both entities influence why data is processed.
2. Jointly determine the means — both entities influence how data is processed (essential means, not just technical implementation details).

Key Indicators