Joint Controllers Under GDPR Article 26: When It Applies and What the Arrangement Needs

The rule

Where two or more controllers jointly determine the purposes and means of processing, they are joint controllers (Article 26(1) GDPR). They must determine their respective responsibilities, in particular for data subject rights and for the information in Articles 13 and 14, in a transparent arrangement, unless the law already sets those responsibilities. The arrangement must duly reflect their roles and relationships towards the people concerned, its essence must be made available to them, and it may designate a contact point (Article 26(1) and (2)).

Whatever the arrangement says, people can exercise their rights against each joint controller (Article 26(3)). And where several controllers are responsible for damage caused by the same processing, each can be held liable for the entire damage, with recourse against the others afterwards (Article 82(4) and (5)).

How to recognise joint control

The EDPB's Guidelines 07/2020 on the concepts of controller and processor (version 2.1) describe the test:

Joint participation in determining both the purposes and the means, either through a common decision or through converging decisions that complement each other and are necessary for the processing to take place.
An important criterion is that the processing would not be possible without both parties, in the sense that their contributions are inextricably linked.
Joint control does not mean equal responsibility: parties can be involved at different stages and to different degrees.
A mere commercial benefit is not a purpose of processing. A provider that processes only on your behalf, with no purpose of its own, is a processor, not a joint controller.

What the Court of Justice has held

Case	Holding
Wirtschaftsakademie (C-210/16, 5 June 2018)	The administrator of a Facebook fan page is a controller, jointly with Facebook, for the processing of visitors' data through the page's statistics
Jehovan todistajat (C-25/17, 10 July 2018)	A religious community that organises and coordinates door-to-door preaching is a joint controller with its members, without needing access to the data or to have given written instructions
Fashion ID (C-40/17, 29 July 2019)	A website that embeds a social plugin transmitting visitors' data to the plugin provider is a controller for the collection and transmission, but only for the operations whose purposes and means it actually determines
Nacionalinis visuomenės sveikatos centras (C-683/21, 5 December 2023)	Joint control does not require an arrangement between the parties; an entity that commissioned an app and took part in determining the purposes and means can be a controller even without processing the data itself
IAB Europe (C-604/22, 7 March 2024)	A sector organisation that sets binding rules for consent signals can be a joint controller with its members even without direct access to the data, but that does not automatically extend to its members' later advertising processing

The pattern: access to the data is not required, a contract is not required, and joint control is assessed operation by operation. If your decisions shape why and how data flows, you are probably in.

Joint controller or processor?

Question	Processor	Joint controller
Whose purpose?	Only the controller's	Each party pursues purposes it has helped to determine
Who decides the essential means (which data, how long, who gets it)?	The controller; the processor may choose technical details	Both, together or through converging decisions
Uses the data for itself?	No; doing so would make it a controller for that use (Art. 28(10))	Yes, for the shared purposes
Contract required	Article 28(3) processing agreement	Article 26 arrangement

Common examples

Social media plugins, pixels and fan pages: the site or page owner and the platform, for the collection and transmission of visitors' data.
Co-branded marketing or joint events: two companies that collect leads together and both use them.
Shared platforms in a group or network: for example a shared customer database whose rules all members set together.
An app built for you by another organisation where both decide how it processes users' data.

By contrast, a hosting provider, payroll provider or CRM vendor that processes only on your instructions is usually a processor; see our data processing agreement checklist.

What the arrangement should cover

The processing operations covered, and those each party carries out alone.
The purposes and the legal basis each party relies on.
Who provides the Article 13 and 14 information, and how.
Who handles data subject requests, and how requests received by the other party are passed on.
A contact point for data subjects, if you designate one.
Security measures and who is responsible for which systems.
Who notifies the supervisory authority and the people affected in case of a breach, and how fast the parties tell each other.
DPIAs, transfers outside the EEA, retention and deletion.
The essence of the arrangement in a form you can publish, for example in your privacy notice.

Supervisory authorities are not bound by how the arrangement labels the parties: they assess the facts. Record the joint processing in your records of processing, including the joint controller's name and contact details (Article 30(1)(a)).

Document the roles. The GDPR Records of Processing (RoPA) Kit includes controller and processor RoPA templates with fields for joint controllers, a data inventory workbook, a completion guide and a legitimate interest assessment.

Joint Controllers Under GDPR Article 26: When It Applies and What the Arrangement Needs

The rule

How to recognise joint control

What the Court of Justice has held

Joint controller or processor?

Common examples

What the arrangement should cover

Sources

Related tools

Data Mapping Tool

Privacy Policy Generator