1. Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information referred to in Articles 13 and 14, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject. The arrangement may designate a contact point for data subjects.
Article 26 GDPR - Joint controllers
2. The arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects. The essence of the arrangement shall be made available to the data subject.
3. Irrespective of the terms of the arrangement referred to in paragraph 1, the data subject may exercise his or her rights under this Regulation in respect of and against each of the controllers.
Frequently Asked Questions
Short answers to common questions about this provision. They are general information and not legal advice.
Article 26(1) makes them joint controllers where they jointly determine the purposes and means of processing. Joint controllership is a factual question about who shapes the why and how of the operation, not a matter of contractual labels, and the definitions of controller in Article 4(7) supply the underlying test.
The arrangement must determine in a transparent manner their respective responsibilities for compliance with the Regulation, in particular for the exercise of data subject rights and for providing the information required by Articles 13 and 14. Under paragraph 2 it must duly reflect the parties' respective roles and relationships vis-à-vis the data subjects, and it may designate a contact point for data subjects.
No. Article 26(1) dispenses with the arrangement in so far as the respective responsibilities of the controllers are determined by Union or Member State law to which they are subject. Where the law allocates the duties only partially, an arrangement is still needed for the remainder.
Paragraph 2 requires that the essence of the arrangement be made available to the data subject. The Regulation does not require publication of the full text, so the joint controllers must convey at least the substance of how responsibilities are divided, typically the allocation of duties concerning rights and information.
No. Article 26(3) provides that, irrespective of the terms of the arrangement, the data subject may exercise his or her rights in respect of and against each of the controllers. The internal allocation binds the controllers between themselves but cannot be invoked to turn a data subject away.