Joint controllership is when two or more organisations jointly decide why and how personal data is processed. Under the GDPR, each joint controller must be clear about responsibilities for notices, rights handling, security, and lawful basis. The main risk is unclear ownership, which leaves gaps in incident response, subject access handling, and compliance evidence.
How Joint Controllership Works
Joint controllership is not the same as one organisation merely processing data for another. It means two or more parties influence the essential decisions about purpose and means, so their relationship must be understood as shared control rather than a simple controller-processor chain.
This distinction matters because accountability cannot be assumed to sit with a single party. If the parties do not agree who handles notices, rights requests, retention, and security decisions, operational gaps can appear exactly where GDPR expects clarity.
Why Joint Controllership Creates Governance Complexity
The hardest part of joint controllership is not the legal label, but the operating model behind it. Each joint controller may have different systems, data uses, and risk tolerances, which makes it easy for responsibility to become fragmented across privacy, security, legal, and business teams.
That fragmentation can affect lawful basis decisions, transparency notices, and the evidence needed to show compliance. Joint controllers should be able to explain who owns each obligation, how decisions are coordinated, and where one party must rely on the other for information or action.
Security and Compliance Responsibilities
Security under joint controllership is shared, but it is not automatically identical. The parties must still make sure that technical and organisational measures are appropriate, that access to personal data is limited to what each party needs, and that escalation paths exist when an incident or rights request touches both sides.
For a practitioner-facing GDPR view of these obligations, GDPR Compliance Guide for Security Teams is a useful reference because it ties lawful basis, Article 32 security of processing, breach notification, and controller-processor boundaries back to day-to-day control design.
When the relationship is unclear, the practical failure is often not a total absence of controls, but inconsistent ownership. One party may believe the other is handling a notice, a deletion request, or a breach assessment, and the resulting delay can become a compliance failure even when both organisations intended to cooperate.
How Organisations Structure Joint Controller Arrangements
A workable arrangement usually starts with a clear internal map of the processing activity, then an agreement that assigns who does what across notices, subject rights, security coordination, and recordkeeping. The goal is not to eliminate shared responsibility, but to make the shared responsibilities executable.
Organisations should also make the arrangement visible to the teams that actually operate it. Privacy, security, and customer-facing staff need a practical view of escalation, ownership, and evidence retention, or the joint-controller agreement will remain a paper document rather than an operational control.
Risk and Threat Considerations
Joint controllership raises risk because shared decision-making can blur accountability at the exact points where GDPR expects speed and precision. If neither party clearly owns incident response, subject access handling, or security evidence, delays and inconsistent responses become more likely.
Failure mechanism: Responsibility drift causes one controller to assume the other will act, which creates gaps in notices, rights fulfilment, breach handling, and proof of compliance.
Impact: The organisation can face incomplete disclosures, missed deadlines, weaker security coordination, and a poor evidentiary position if a regulator asks who made, approved, or executed a decision.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
GDPR and ISO/IEC 27001:2022 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| GDPR | Art. 26 — Joint Controllers | Defines shared controller responsibility for why and how data is processed |
| Art. 5 — Principles Relating to Processing of Personal Data | Sets accountability, purpose limitation, and transparency obligations affected by joint control | |
| Art. 32 — Security of Processing | Requires shared technical and organisational security measures for personal data processing | |
| Recommendation — Document each party's responsibilities for notices, rights handling, security, and accountability. Align joint processing decisions to lawful purpose, minimisation, and accountable recordkeeping. Coordinate security controls and incident handling across all joint controllers. | ||
| ISO/IEC 27001:2022 | A.5.2 — Information security roles and responsibilities | Joint controllership needs explicit assignment of security responsibility across parties |
| A.5.31 — Legal, statutory, regulatory and contractual requirements | Joint controllership depends on meeting GDPR duties through documented obligations | |
| Recommendation — Assign security ownership and escalation paths so shared control does not create gaps. Map contractual duties to regulatory obligations and keep them current as processing changes. | ||
Practitioner Guidance
Governance implication: Treat the joint-controller arrangement as an operating model, not just a legal appendix. The arrangement should assign decision ownership, escalation paths, and evidence ownership in language that the security and privacy teams can actually use.
What to watch for: If the same obligation is described differently in separate teams, or if no one can quickly explain who responds to an access request, a breach, or a notice update, the governance model is too ambiguous.
Practitioner takeaway: Joint controllership works best when the parties can each answer the same question the same way, namely who owns the action, who supplies the evidence, and who is accountable if the control fails.
Related resources from NHI Mgmt Group
- Why do joint ventures complicate CMMC compliance?
- Why do DDoS and ransomware require joint resilience planning?
- What happens when NHS organisations try to deliver digital transformation without shared governance or joint ownership?
- What do teams get wrong about joint controllers in GDPR implementations?