Article 26
Joint controllers
Chapter 4
|
Controller and Processor
|
📖 2 min read
1. Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information referred to in Articles 13 and 14, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject. The arrangement may designate a contact point for data subjects.
2. The arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects. The essence of the arrangement shall be made available to the data subject.
3. Irrespective of the terms of the arrangement referred to in paragraph 1, the data subject may exercise his or her rights under this Regulation in respect of and against each of the controllers.
Understanding This Article
Article 26 addresses situations where multiple organizations work together to process personal data, jointly determining why and how processing occurs. This is common in business partnerships, industry collaborations, data sharing arrangements, and multi-party platforms. The CJEU's Fashion ID case clarified that joint control doesn't require equal involvement—even limited shared decision-making (like embedding social media plugins) can create joint controllership.
The mandatory arrangement (paragraph 1) must transparently allocate GDPR compliance responsibilities. This isn't just an internal contract—it affects data subjects' ability to understand who's responsible for what. The arrangement must specify which controller handles access requests, who provides privacy notices, who manages data subject rights, and how responsibilities are divided. While controllers can allocate duties internally, this doesn't limit data subjects' rights.
Paragraph 3's crucial protection ensures data subjects aren't disadvantaged by joint controllership. Regardless of internal arrangements, data subjects can exercise any GDPR right against any joint controller. If a data subject requests erasure, they can approach whichever controller is most accessible—that controller can't refuse by claiming "we're not responsible for that under our arrangement." Joint controllers must coordinate internally to fulfill requests.