The controller remains accountable for fulfilling the request, even if a processor helps retrieve data or draft the response. In joint-controller arrangements, each controller can be exercised against directly by the data subject, so governance must ensure coordinated handling and deadline control. If responsibilities are split, the arrangement still needs clear operational ownership and technical measures to prevent missed responses.
Who holds the obligation when a processor is involved?
The legal and operational obligation sits with the controller. A processor may execute retrieval, redaction, assembly, or drafting tasks, but it does not take over accountability for the subject access request. The practical test is simple: if the request is missed, incomplete, or delayed, the controller is the party that remains answerable for the failure.
That division matters because processors often hold the records or the systems needed to respond, yet they act only under instruction. The controller therefore has to define the scope of the request, confirm what data is in play, and ensure the processor can support the deadline without changing who owns the obligation.
How joint controllers change the accountability model
Joint-controller arrangements do not dilute the subject’s right to enforce the request. Each controller can be approached directly, so governance must make clear how the request will be routed, who coordinates the response, and which party owns timing, completeness, and final issuance. The arrangement can split tasks, but it cannot split away the duty to make the response work.
Where responsibilities are divided, the arrangement should translate that split into an operational path the data subject never has to navigate. The controls that matter are coordinated intake, shared evidence handling, and a single source of truth for response status. Without that, joint control becomes a coordination problem rather than a compliance model.
Clear allocation also helps when the request touches multiple systems or business units. If one controller has the primary relationship with the individual and another holds a narrower dataset, the response still needs a single accountable process so that partial ownership does not become partial delivery.
What governance must be in place to meet the deadline
Subject access requests fail most often because ownership is unclear, data discovery is fragmented, or the response path depends on informal follow-up. For that reason, the controller should maintain a defined intake process, escalation path, and cross-functional handoff model before a request arrives. That is especially important when access governance and entitlement visibility affect where personal data is stored and who can retrieve it.
Processor support should be contractual and operational, not ad hoc. The controller should be able to direct the processor to search, export, or verify records quickly, while preserving control over the final disclosure decision. In practice, that means the controller owns the response calendar, the processor owns delegated tasks, and the evidence trail shows when each handoff occurred.
Where identity data, retention rules, or delegated access are involved, the handling model should also be consistent with privacy and consent controls. That is why a privacy and consent control baseline is useful when designing the workflow around request validation, disclosure scope, and retention of response records.
Risk and Threat Considerations
The main risk is missed, incomplete, or inconsistent disclosure when responsibility is split across parties. A processor can delay retrieval, a joint controller can assume another party is handling the request, and the result is a missed deadline or an incomplete response that creates regulatory and reputational exposure.
Failure mechanism: Ambiguous ownership, poor system visibility, and weak coordination cause one party to wait for another while the statutory clock keeps running. In joint-controller settings, inconsistent records or mismatched interpretations of scope can also lead to partial disclosure or duplicate handling.
Impact: The organisation may miss response deadlines, provide an incomplete data package, or fail to evidence lawful handling of the request. That can trigger complaints, supervisory scrutiny, remedial work, and loss of trust in the organisation’s privacy operations.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
GDPR provides the primary governance reference for this topic.
| Framework | Control / Reference | Relevance |
|---|---|---|
| GDPR | Art. 12 — Transparent information, communication and modalities for the exercise of the rights of the data subject | Governs timely handling of subject access requests and coordination of responses. |
| Art. 15 — Right of access by the data subject | Directly defines the subject access request obligation discussed here. | |
| Art. 26 — Joint controllers | Requires transparent allocation of responsibilities in joint-controller arrangements. | |
| Recommendation — Set a single response owner and deadline tracker for all data subject requests. Provide a complete access response that covers all personal data in scope. Document which controller handles intake, coordination, and response issuance. | ||
Practitioner Guidance
What to verify: Confirm that every processor and joint-controller arrangement has a named operational owner for subject access requests, a deadline tracker, and a documented escalation path. If the request spans multiple data stores, verify that search and export responsibilities are mapped before the request is received.
Decision rule: If a processor is needed to retrieve data, treat the processor as a task executor, not as the accountable party. If joint controllers are involved, route the request through one coordinated workflow with one owner for timing and completeness, even if several teams contribute evidence.
Common mistake: Treating “shared responsibility” as if it means shared accountability. In practice, that creates gaps at the exact point where the response deadline and disclosure quality need the most disciplined ownership.
Practitioner takeaway: The controller must remain the accountable party, so the real control problem is not deciding who is liable in theory, but making sure the operating model can prove one owner, one clock, and one controlled response path.
Related resources from NHI Mgmt Group
- Who should be accountable for meeting GDPR breach notification and subject access deadlines?
- How should security teams run access reviews for non-human identities?
- How should security teams govern non-human identities that have persistent access?
- When do NHI access reviews create more value than a one-time cleanup?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
