Joint Controllers (Article 26 GDPR)

Joint controllership exists where two or more controllers jointly determine the purposes and means of a processing operation. It must be distinguished from processing on behalf of a controller (one body acts on another's instructions) and from separate controllership (each body decides independently).

1 Existence of joint controllership

1.1 Basic concept

The assessment proceeds in two steps. First, it must be established for each body involved whether it is a controller at all, that is, whether it co-determines the purposes and the essential means and does not merely act on instructions as a processor. Only then does the question arise whether several controllers determine the purposes and means jointly.

A deliberate, conscious interaction is required. Where several bodies process the same data alongside one another purely by coincidence, without any coordinated determination, there is no joint controllership but separate controllership.

1.2 Criteria

According to the case law, the requirements attaching to the element of acting "jointly" are low:

• No determination on an equal footing required. It is sufficient that a body does not determine the purposes and means alone or that it aligns itself with the other party's decision. "Jointly" means "together with" or "not alone". Nor must the parties involved pursue the same purposes; it is enough that their decisions complement each other and are mutually dependent.
• Inseparable processing. A key criterion is that the processing would not be possible without the simultaneous involvement of the parties, so that their processing activities are inextricably linked with one another.
• No access to the data required. A body may be a joint controller even where it has no access to the data or receives them only in anonymized or pseudonymized form. What is decisive is the influence on the decision, not the possibility of access.
• Limited scope. Joint controllership extends only as far as the what for and the how are in fact determined jointly. Where a project consists of several work packages or stages, these must be assessed separately if they are not inextricably linked.
• Purpose or means suffice. Under the interpretive guidance of the supervisory authorities (EDPB, Guidelines 07/2020 on the concepts of controller and processor), not every body must decide on the purpose and the means at the same time. Complementary (converging) decisions suffice, for example where one body provides the means and the other decides to make use of them as well, provided that both exert a tangible influence on the processing.
• A shared benefit is not sufficient. A merely mutual benefit from a processing operation, including an economic one, does not in itself establish joint controllership; the joint determination of purpose and means remains necessary.

The supervisory authorities illustrate these criteria with examples. They assume joint controllership, for instance, where a travel company, a hotel chain and an airline set up a joint booking platform and decide together on its purposes and essential functions, or where several companies jointly determine the target audience and the data to be analyzed for a joint, co-branded marketing campaign. In the case of a platform that pools data for the complementary research purposes of several institutes, joint controllership may likewise exist for the pooling itself. By contrast, there is no joint controllership where a service provider processes data on behalf of several companies without those companies coordinating purposes and means among themselves, or where data are merely passed along a chain, for example from an employer to the tax authorities, each of which decides independently on its own processing. Where a body merely provides a technical system or an infrastructure without co-determining the purposes of the individual users, it is not a joint controller for that reason alone.

Practical indicators of joint controllership are jointly agreed purposes, a project description drawn up and followed jointly, a shared infrastructure (for example a common database) as well as complex processing operations involving many parties and an unclear allocation of responsibilities.

1.3 Categories of cases

1.4 Leading judgments of the CJEU

The CJEU has interpreted joint controllership broadly and has developed the criteria set out above in doing so.

1.5 Scope and practical limits

The broad interpretation carries the risk of overextending joint controllership. Three limitations are important in practice:

• Limitation to the joint stages. A body is a joint controller only for those processing operations it actually co-determines. It bears no responsibility for downstream operations determined solely by the other body (this being the limitation drawn in the Fashion ID judgment).
• Actual ability to exert influence. What is decisive is whether a body is genuinely able to influence the processing. A party that is merely exposed in fact to a predetermined processing operation, without being able to steer it, is not a joint controller for that reason alone.
• Narrow subject matter of the assessment. In doubtful cases, the individual processing activity pursued for a specific purpose is to be examined, rather than the cooperation as a whole in blanket fashion. This makes it possible to clarify for which operations a joint determination in fact exists.

2 Arrangement between joint controllers

2.1 Obligation and form

Joint controllers must determine in an arrangement which of them fulfills which obligations under the GDPR, in particular as regards the exercise of the rights of the data subject and the duties to provide information under Articles 13 and 14 GDPR (Article 26(1), second sentence, GDPR). No particular form is prescribed; for evidentiary reasons, a written or electronic version is strongly recommended.

The arrangement is not constitutive: joint controllership arises from the actual joint determination, not from the contract. The absence of an arrangement is subject to fines (Article 83(4)(a) GDPR), but it does not render the processing itself unlawful (CJEU, judgment of 4 May 2023, C-60/22).

2.2 Minimum content

The arrangement must duly reflect the respective actual roles and relationships of the parties vis-à-vis the data subjects (Article 26(2), first sentence, GDPR). Beyond that, it may govern further points, similar to a data processing agreement.

The obligations need not be allocated evenly. An asymmetric allocation is permissible, under which one body assumes certain tasks in full, for example responding to all data subject requests, even where the other body has no access to the data.

2.3 Making the essence available to data subjects

The essence of the arrangement must be made available to the data subjects (Article 26(2), second sentence, GDPR). In practice, this is regularly done in the privacy notice, which discloses that joint controllership exists, who is involved and whom data subjects may contact.

2.4 Legal consequences and strategic considerations

Irrespective of the internal allocation, the data subject may exercise his or her rights in respect of and against each of the controllers (Article 26(3) GDPR). Externally, joint controllers are jointly and severally liable (Article 82 GDPR); the internal apportionment follows the arrangement. Joint controllership brings no relief as regards the legal basis: each party requires a legal basis of its own under Article 6 GDPR, and there is no group privilege.

Unlike in the case of processing on behalf of a controller, joint controllers are third parties and recipients in relation to one another (Article 4(9) and (10) GDPR); the joint determination of the purposes specifically does not privilege the passing on of data. Where one body passes data to the other or makes them accessible to it, that operation is therefore a step of transmission that must be justified in its own right and requires its own legal basis under Article 6 GDPR (and, in the case of special categories, Article 9 GDPR in addition). The arrangement under Article 26 GDPR does not replace that legal basis; it presupposes it.

In addition, each joint controller may be the sole addressee of measures taken by the supervisory authority. Infringements of the obligations under Article 26 GDPR, in particular the absence of the arrangement, are subject to fines (Article 83(4)(a) GDPR, up to EUR 10 million or 2% of the total worldwide annual turnover of the preceding financial year).