Joint Controller

What Joint Controllers Actually Are

Joint controllership is not the same as outsourcing. Two or more organisations can jointly determine the purposes and means of processing while still remaining separate legal entities, so the key question is who decides, not who performs the work. That distinction matters because accountability under GDPR follows the decision-making role, not just the operational arrangement.

Why Joint Controller Arrangements Matter

Joint controller relationships are common where organisations collaborate on a shared service, platform, campaign, or customer journey. The arrangement creates a governance layer above the day-to-day processing steps: parties need a clear understanding of the shared activity, their respective responsibilities, and how they will present those responsibilities to individuals. Without that clarity, transparency obligations and rights handling can become inconsistent across the joint activity.

The practical challenge is that each controller may rely on different internal teams, vendors, or systems to execute parts of the processing, but those divisions do not remove the underlying shared accountability. A well-drafted arrangement should map the decision points that are shared, the tasks each party carries out, and the process for coordinating responses to data subject requests and security issues.

Shared Accountability Under GDPR

Joint controllers remain individually responsible for complying with GDPR duties that attach to the shared processing, even when the work is split operationally. That typically includes lawful basis, transparency, data minimisation, security, retention, and the handling of access, rectification, erasure, and objection requests. The arrangement should not be treated as a way to transfer liability away from either party.

For practitioners, the important issue is traceability. If one party determines the purpose while another controls the platform or customer interface, the organisation still needs to show who owns which obligation and how those obligations are fulfilled in practice. This is why joint controller arrangements are as much about governance records and escalation paths as they are about contracts.

How to Recognise a Joint Controller Relationship

Shared controllership usually exists where the parties together decide the “why” or the essential “how” of processing, even if they do so through different systems or teams. It is more likely when both parties benefit from the same processing outcome, jointly shape the user experience, or jointly influence what data is collected and for what purpose. It is less likely when one party merely processes data strictly on instruction and has no real say in the core decisions.

That distinction can be subtle in modern data ecosystems, especially where cloud platforms, embedded analytics, co-branded services, or shared marketing operations blur organisational boundaries. The legal label should follow actual control over purposes and means, not the wording of a commercial contract.

Risk and Threat Considerations

Joint controller arrangements create risk when responsibility is shared but execution is fragmented. The main failure mode is unclear ownership, where each party assumes the other is handling transparency, consent or another GDPR duty, leaving gaps in compliance and response handling.

Failure mechanism: Ambiguous governance or weak coordination leads to inconsistent notices, incomplete rights handling, or delayed incident response across the shared processing activity.

Impact: Individuals may receive incomplete information or fragmented responses, and both parties can face regulatory exposure, remediation burden, and trust damage if the shared activity is challenged.

Practitioner Guidance

Governance implication: Treat the joint controller relationship as an operating model, not just a clause in a contract. The arrangement should clearly state which party handles transparency, which party receives and routes rights requests, and how security or breach issues are escalated between the parties.

What to watch for: Misalignment between the legal arrangement and the actual data flow is a common warning sign. If the parties cannot explain, in plain terms, who decides the purpose, who determines the essential means, and who answers for each GDPR obligation, the arrangement is probably under-specified.

Related resources from NHI Mgmt Group

• What happens when social media providers and targeters do not define joint controller responsibilities clearly?
• Joint Data Controller
• How should security teams reduce Kubernetes controller blast radius?
• How should security teams govern a software-defined network controller?