What are common mistakes with joint controllership?

How joint controllership mistakes usually start

The most common error is treating joint controllership as a paperwork exercise instead of a real operating model. If two organisations jointly decide the purposes and essential means of processing, the label follows the facts, not the contract. A well-drafted agreement helps, but it cannot override the actual decision-making pattern or turn independent decision-makers into a simple controller-processor chain.

This is why teams should start by mapping who influences the purpose, scope, data categories, retention, disclosure and onward sharing of the personal data. If both parties shape those choices, the privacy analysis needs to reflect joint control even when the commercial relationship is framed as a partnership, referral arrangement or platform integration.

Which obligations get missed most often

Another frequent mistake is underestimating how much joint controllership changes day-to-day privacy work. The obligation is not just to sign an arrangement, but to make the division of responsibilities operational. That usually means deciding who handles notices, who responds to rights requests, who retains evidence, and who owns escalation when a request spans both organisations.

Transparency is where many arrangements fail first. If each party tells a different story about why the data is collected, who receives it or how rights are exercised, the privacy notice set becomes inconsistent and users are left without a clear path. A GDPR Compliance Guide for Security Teams is useful here because it connects controller responsibilities, processing transparency and security of processing into one operational view.

Teams also overlook partner data flows after the agreement is signed. Joint controllership is not static, because integrations, product changes and new campaign paths can alter who decides what. If the actual flow changes but the allocation of duties does not, the organisation may keep relying on an outdated responsibility split that no longer matches the processing reality.

Why joint controllership becomes a governance problem

Joint controllership becomes risky when no one owns the whole lifecycle of the relationship. Each party may assume the other is covering notices, rights handling, retention or data minimisation, and that gap is exactly where compliance failures accumulate. The mistake is not only legal drafting, but the absence of a practical control owner for shared obligations.

That is why privacy and security teams should treat partner reviews as recurring governance work, not one-off onboarding. The strongest control is a clear map of decision rights, a current inventory of shared data flows and a documented process for reviewing whether the arrangement still reflects how the organisations actually operate. The Top 10 Privacy Compliance Mistakes is a useful companion because it highlights the recurring failure modes around notices, rights handling, retention and processor or transfer assumptions.

For broader accountability and security control expectations, teams can anchor their review in the EU General Data Protection Regulation (GDPR) and the NIST SP 800-53 Rev 5 Security and Privacy Controls when they need a control-based way to evidence responsibilities, access governance and auditability.

Practitioner Guidance

What to verify: Verify whether the parties jointly decide any essential element of processing, especially purpose, audience, retention and sharing. If the decision record is unclear, the agreement is probably describing the relationship too simplistically.

Decision rule: If either party can materially change why the data is used or how the core processing works, treat the arrangement as requiring explicit shared responsibility mapping, not just a commercial contract review.

What practitioners underestimate: The operational burden is usually in rights handling and notice consistency, not in the signature page. The arrangement should be tested against real data flows, real request paths and real change management, because those are the points where misalignment shows up first.

Practitioner takeaway: The safest posture is to document joint controllership from the actual decision structure outward, then keep validating that the legal split still matches the live processing model.

Related resources from NHI Mgmt Group

• What are the most common mistakes organisations make when launching green banking or telecom initiatives?
• What are the most common mistakes organizations make in a NIST SP 800-171 self-assessment?
• What are the most common mistakes teams make when implementing two-factor authentication for accounts?
• What are the most common mistakes teams make when hardening access to a cloud warehouse?