Joint controller arrangement

A joint controller arrangement is mandatory under Art. 26 GDPR whenever two or more controllers jointly determine the purposes and means of processing personal data. Unlike processing on behalf of a controller, no party acts solely on the instructions of another; instead, all parties share responsibility. The arrangement must set out in a transparent manner who fulfils which obligations under the GDPR, in particular with regard to exercising the rights of data subjects and meeting the information duties under Art. 13 and 14 GDPR.

The arrangement must duly reflect the respective actual roles and relationships of the joint controllers vis-à-vis the data subjects. It must designate a point of contact for data subjects, and the essence of the arrangement must be made available to them. Crucially, data subjects may exercise their rights against each individual controller regardless of the internal allocation of tasks (Art. 26(3) GDPR); the arrangement therefore does not limit liability in the external relationship with data subjects.

Distinguishing joint controllership from processing on behalf of a controller and from separate controllership is decisive in practice and often difficult. What matters is the factual co-determination of purposes and means, not the contractual label. The CJEU has interpreted the concept of joint controllership broadly (for example in the Wirtschaftsakademie and Fashion ID rulings). A missing or inadequate arrangement can be sanctioned with fines under Art. 83(4) GDPR and regularly creates legal uncertainty when data subjects seek to exercise their rights.