Article 26 joint controllers: requirements and evidence

What Article 26 asks joint controllers to settle in writing

If your company shares personal data with a partner and both of you decide why and how that data is processed, Article 26 expects you to be joint controllers and to settle, in a transparent written arrangement, who does what. Article 26(1) asks you to determine your respective responsibilities, in particular for responding to data subject rights and for meeting the duties to inform people about the processing. The point is that a data subject should never face a gap where each party assumes the other is answering. The arrangement is the document that closes that gap, and it has to match how the processing actually runs, not how the contract says it runs.

Article 26(2) requires that the essence of the arrangement be made available to data subjects, so the allocation cannot live only in a private annex. Article 26(3) adds that a data subject may exercise their rights against each controller, whatever the arrangement says between them. In practice this means a single request sent to either party must be handled, forwarded or answered in time. Decide who owns intake, identity checks and the response deadline, and confirm with your partner how requests reach each other. The EDPB Guidelines 07/2020 recommend a binding document that also covers the legal basis, security measures, breach notification, DPIAs, processors, third-country transfers and contacts with authorities. The EDPB Guidelines 9/2022 specifically recommend naming which controller leads on breach notification.

The arrangement is hard because the parties often disagree about who really decides the means, and because each side holds different systems, logs and staff. Ask your partner to map each processing step to the party that controls it, then test the draft against a realistic scenario, such as a rights request that arrives at the wrong party or a breach discovered in the partner's system. Confirm with your own counsel and data protection officer whether the joint controller finding holds for each activity, since an incorrect label changes every duty that follows. The arrangement must be reviewed when the processing changes, and the record of who owns each duty should be kept under version control so both parties can show what was agreed and when.

When a shared-decision relationship triggers Article 26

Article 26 applies only when two or more parties jointly determine purposes and means, so the first job is deciding who actually makes those decisions. The cards below cover the scoping calls that most often change which systems, contracts and teams fall inside the joint controller arrangement.

Purposes and means decided jointly

Start with the distinction in EDPB Guidelines 07/2020: a party that decides why data is processed and which essential means are used is a controller, and two parties that make those decisions together are joint controllers. Check who sets the purpose, who chooses the data elements and retention, and whether each party's decisions shape the outcome. If both parties shape the purpose, treat the relationship as joint until analysis shows otherwise.

Processor on documented instructions

When one party acts only on another's documented instructions and has no say in purposes, it is a processor under Article 28, not a joint controller. This is the most common misclassification in vendor reviews. Confirm that the vendor cannot reuse the data for its own purposes, and that changes to the configuration come from the client. If the vendor starts using data for its own product improvement, the analysis must be reopened.

Shared platforms and common databases

A shared CRM, identity store or analytics warehouse used by several group companies or partners can create joint control over the records they hold together. Map each system to the parties that set its purposes, who can write to it, and who decides retention. Each shared system then needs its own arrangement, access model and breach contact, so the inventory should list them separately rather than under a single vendor entry.

Co-marketing and shared campaign data

Joint campaigns, co-branded events and lead-sharing programs often involve two companies choosing audiences, tools and retention together. Ask who defines the target criteria, who owns the lead list after the campaign, and who answers opt-out requests. Marketing platforms, consent logs and suppression lists are typically in scope, and they are often managed by teams outside the security function.

Group entities and intra-group sharing

Separate legal entities in one group are separate controllers unless they jointly decide purposes and means. Shared HR, payroll or customer systems often blur that line. Document which entity decides each purpose, which entity hosts the system, and whether the group has a central policy that binds all entities. Confirm this with legal counsel, since the answer depends on actual decision-making, not on the corporate chart.

Third-party tools the client configures

When a vendor supplies a tool but the client chooses its tracking scripts, custom fields, audience settings or data flows, the client may be a controller with shared responsibility for how the tool processes data. A tag manager, analytics pixel or embedded widget illustrates the point. Inventory each configured integration, record who set its parameters, and check whether the vendor's own use of the data falls outside the client's instructions.

How to build and maintain the arrangement

The sequence below moves from knowing what is shared to a signed document, working runbooks and a review habit, so each joint controller can show who owns which duty and how it is carried out in practice.

Map shared processing and systems
List every processing activity the parties run together, the purposes they set jointly, and the systems, databases, tools and vendors that hold the data for each one. Record which party decides the purpose, which decides the means, and where the data flows between them. The output is a shared processing inventory signed off by each party's privacy and security leads. You know it is done when every system in the inventory has a named owner on each side and no data flow is described only as "shared."
Confirm joint control for each activity
For each activity in the inventory, test whether the parties really decide purposes and means together, or whether one party decides and the other only processes on its instructions. This decides whether Article 26 applies or whether a processor contract under Article 28 is the right instrument. Record the reasoning in a short memo per activity, citing the EDPB Guidelines 07/2020 concepts. The output is a decision log that a supervisory authority or auditor could follow.
Allocate responsibility for each duty
Build a responsibility matrix with one row per duty and one column per party. Cover rights requests, information notices, lawful basis records, security measures, breach notification lead, DPIAs, use of processors, third-country transfers, and contacts with data subjects and supervisory authorities. Mark one party as the single point of contact for each duty and record who answers if that party is unavailable. The output is a matrix that every row has one accountable owner and a documented fallback.
Draft the binding arrangement
Turn the matrix into a written arrangement that sets out the parties' respective responsibilities, makes the essence available to data subjects, and states that individuals may exercise rights against each controller. EDPB Guidelines 07/2020 recommend a binding document that also covers principles, legal basis, security measures, breach notification, DPIAs, processors, transfers and authority contacts. Have counsel review it, and confirm the lead for breach notification as EDPB Guidelines 9/2022 advise. The output is an approved, signed arrangement and a published summary of its essence.
Define runbooks and named contacts
Write an operational runbook for each recurring duty, such as receiving and routing a data subject request, a security incident, a breach assessment and a supervisory authority inquiry. Each runbook names the steps, the responsible party, the handover to the other controller, and the internal escalation path. Keep a current contact register with names, roles and out-of-hours routes for both parties. The output is a set of tested runbooks and a contact register that someone other than the author has walked through.
Implement controls and evidence capture
Configure the systems so the allocated duties can be carried out and proven. Give each party access that matches its role, log actions on shared data, and keep the arrangement, runbooks and version history in a controlled document store. Open-source wiki and documentation platforms can record every change with its author and date and allow comparison and rollback, and role-based permissions can limit who edits each part. Confirm each capability in your own environment before relying on it. The output is a dated evidence set that shows the arrangement operates, not only that it exists.
Test the handoffs with a tabletop exercise
Run a scenario, such as a rights request that arrives at the wrong controller or a breach affecting data held by both parties, and follow the runbooks end to end. Record where the handoff stalled, which contact was missing, and which decision was unclear. Update the matrix, the arrangement or the runbook to close each gap. The output is an exercise report with dated findings and the changes made, which becomes evidence of operational control.
Review the arrangement on every change
Reopen the mapping, matrix and arrangement whenever a new purpose, system, vendor, transfer route or joint activity is introduced, and whenever a party's role or contact changes. Confirm that the review is triggered by change rather than only by a calendar, and that each review produces a dated record of what was checked and who approved it. The output is a revision history of the arrangement and a change log that links each update to the trigger that caused it.

How an assessor tests the joint controller arrangement

This table compares each assessor test of a joint controller arrangement with the evidence requested and the gaps assessors most often find. Read it as a checklist for preparing the arrangement before a regulator, auditor or customer asks to see it.

Test approach	Evidence requested	Common findings
Review the signed arrangement against the Article 26 elements	The executed arrangement, its version history, and a mapping of each party's responsibilities for rights, notices, security, breaches and contacts	Responsibilities are described in general terms, or the document is unsigned, undated or missing one of the joint controllers
Confirm the essence of the arrangement is available to data subjects	The published summary or privacy notice text, the date it was last updated, and the channel through which it is provided	The essence is buried in a contract annex, or the published text contradicts the signed arrangement
Sample how a data subject rights request was routed	Intake records, timestamps, routing decisions and the response sent, for a sample of requests that reached each party	Requests land with one party, no one owns the response, or the other controller is never informed
Check breach-lead designation against EDPB Guidelines 9/2022	A named lead controller for notification, the contact route to the other party, and the escalation steps in the breach plan	No lead is named, both parties assume the other will notify, or the lead's contact details are out of date
Test whether the arrangement is applied in day-to-day operations	Access reviews, shared system configurations, staff training records and meeting or escalation logs between the parties	Staff are unaware of the arrangement, and systems follow one controller's practice rather than the agreed split
Find gaps where the arrangement exists only on paper	Comparison of the document with actual data flows, processor lists, transfer records and the DPIA for the shared processing	Processors or transfers added after signing are missing, and the DPIA does not reflect the joint processing
Check version control and change approval	Revision history showing who changed the arrangement, when, and whether each party approved it	Changes are made by email with no record, or one party holds an outdated copy

Evidence that shows the arrangement works

An Article 26 arrangement is only as good as the records behind it. The cards below cover the artifacts a regulator or joint controller would ask to see, and each one shows who acted, when, and under which version of the arrangement. Keep them current between reviews so that the arrangement describes how the parties actually work.

Signed arrangement and version history

The binding document that allocates responsibilities between the joint controllers, with signatures, dates and the version in force at each point in time. EDPB Guidelines 07/2020 recommend a binding document, so check that every party signed the same text and that each amendment has its own approval record. Keep the history in version control so you can show what changed, when and by whom, and which version governed a given processing period.

Published essence text

The summary of the arrangement made available to data subjects under Article 26(2). Confirm that it matches the signed document in substance, names a contact point and explains how people can exercise their rights against any controller. Review it whenever the purposes, systems or responsible parties change, and record the date of each publication so you can show what individuals were told at the time.

Rights request routing runbook

The step-by-step procedure that tells staff at each controller how an incoming request is forwarded, acknowledged and answered, including which party is the single point of contact. Test it with a sample request at least once between audits and record the timestamps. A runbook that names roles rather than individuals stays accurate when people change jobs.

Breach lead matrix

A table that names the controller responsible for notifying the supervisory authority and data subjects for each category of incident, along with the backup contact. EDPB Guidelines 9/2022 expect the arrangement to state this lead role clearly. Walk through a tabletop scenario with both parties and keep the outcome, because the matrix is only useful if each contact knows they hold it.

Joint DPIA records

Impact assessments covering processing that the joint controllers carry out together, with their agreed risk treatments and the owner of each measure. Confirm that each controller has the assessment in its own records and that it is reviewed when the processing or the shared systems change. Note any residual high risk and whether prior consultation was considered.

Access records and review minutes

Access logs and account reviews for shared systems, plus the minutes of periodic reviews where both parties confirm roles, open issues and changes to the arrangement. Export access lists on a fixed schedule, compare them with the people who should hold access, and record each removal. Dated minutes that show decisions and follow-up actions are often the clearest proof that the arrangement is operated, not only written.

What meeting Article 26 costs in money and effort

This table lists the cost components of a joint controller arrangement, who usually carries each one, whether it is one-time or recurring, and what drives it up. No fee or duration figures are supplied for this topic, so use the right-hand column to scope a quote and compare proposals on the same basis.

Cost component	Who is paid or who carries it	One-time or recurring	What drives it and what to request in a quote
Legal drafting of the joint controller arrangement	External counsel or in-house legal team	One-time, with periodic review	Number of processing activities and partners. Request a fixed scope listing the processing operations, roles and clauses to be drafted.
Mapping who decides purposes and means	Privacy lead, business owners and engineering staff	One-time, updated on change	Number of shared systems and data flows. Ask whether the mapping covers each system and who signs off each entry.
Engineering for routing and rights requests	Internal platform team or implementation partner	One-time build, then maintenance	Number of intake channels and systems holding shared data. Request a list of routing components, the systems they touch and test steps.
Access controls and logging across partners	Internal security team or implementation partner	One-time build, then recurring reviews	Number of partner accounts and jurisdictions with access. Ask how role-based permissions and audit logs will be configured and tested.
Breach notification workflow between controllers	Internal incident response team, with counsel for wording	One-time setup, recurring exercises	Number of partners that must be notified and their contact chains. Request the contact matrix, the lead controller designation and test plan.
Evidence upkeep (agreements, logs, change history)	Internal compliance or privacy team	Recurring	Frequency of changes to partners, purposes and systems. Ask how versions of the arrangement and access reviews will be kept and retrieved.
External review and independent assessment	Independent auditor, assessor or certification body, or external counsel	Recurring, depending on the review cycle	Scope of review, number of arrangements sampled and whether an assessment is required by a customer or contract. Confirm with the reviewer before engaging.

Who drafts, implements and checks the arrangement

Your organization owns the arrangement. Under Article 26(1), joint controllers must determine their respective responsibilities in a transparent way, and that allocation is a decision about purposes, lawful basis, who answers to data subjects and who leads on breach notification. Those choices belong to the people who hold the legal and commercial accountability, usually with legal, the DPO where one is designated, and the business owner of the processing. The EDPB Guidelines 07/2020 describe the arrangement as a binding document, so counsel should review the final text and sign-off should be recorded.

Legal allocation: Decide who handles rights requests, notices and contacts with supervisory authorities for each stage of the processing.
Lead on breaches: Name which controller notifies the supervisory authority and affected individuals, as EDPB Guidelines 9/2022 recommend stating explicitly.
Business decisions: Confirm the purposes and means each party controls, since these determine whether you are a joint controller at all.
Approval and review: Keep the signed arrangement, its version history and the date of each review.
Operational accountability: Ensure staff who run the shared processing know which tasks the arrangement assigns to them.

Check that every allocation in the document matches what your teams do in practice, because an arrangement that differs from actual conduct is weak evidence.

Where joint controller arrangements usually fall short

Most Article 26 problems are not missing paperwork. They are arrangements that exist on paper but do not match how data actually flows, who answers the phone, or who notifies the regulator. The cards below cover the gaps assessors and regulators tend to find, each with a closing action you can check against your own arrangement.

Arrangement is not binding

A policy statement, a shared slide deck or an email thread does not allocate responsibility in a way the parties must follow. EDPB Guidelines 07/2020 recommend a binding document. Check that the arrangement is signed by every party, has an owner, and sets out who does what for rights, notices, security and breaches. Close it by getting a signed, dated agreement that names each party's duties in writing.

Arrangement is not transparent

Article 26(1) requires the respective responsibilities to be determined in a transparent way. Gaps appear when responsibilities are vague, such as "both parties handle security", or when the split is known only to the lawyers who drafted it. Check that a reader outside the contract can tell who answers a access request and who fixes a leaked database. Close it by writing a responsibility matrix per processing activity and keeping it under version control.

Essence not made available

Article 26(2) requires the essence of the arrangement to be made available to data subjects. Many organizations sign a detailed agreement and never publish a summary, or publish one that omits who the data subject should contact. Check that your privacy notice or a linked page states the allocation of roles and a contact point. Close it by publishing a plain summary of the arrangement and confirming the wording matches the signed agreement.

No designated breach lead

When a personal data breach occurs, each controller has its own notification duty, and the clock starts when it becomes aware of the breach. EDPB Guidelines 9/2022 recommend that the arrangement state which controller leads on breach notification. Check that the lead is named, that the other party knows when to pass them information, and that a 24-hour contact path exists. Close it by naming the lead controller and the contact chain in the agreement and in your incident runbook.

Rights requests lost between parties

Article 26(3) lets a data subject exercise rights against each controller regardless of the arrangement, so a request sent to one party must not disappear. Gaps include intake forms that route to a shared mailbox nobody reads, or two controllers each assuming the other will erase a record. Check that each party has an intake channel, a forwarding rule and a shared deadline tracker. Close it by testing one erasure request end to end across both parties and recording the timestamps.

Processors used without flow-down terms

Joint controllers often share a hosting provider, analytics tool or support vendor without making that processor's terms match the arrangement. The result is a processor that is not bound to the same instructions, deletion rules or sub-processor limits. Check that each processor has a contract under Article 28 that reflects the joint arrangement and that its sub-processor list is known to both controllers. Close it by mapping every shared processor and confirming its contract covers the joint purposes.

Questions buyers ask about Article 26

Does Article 26 always require a joint controller arrangement?

No. Article 26 applies only when two or more controllers jointly determine the purposes and means of processing. If one party only provides a service and follows the other's documented instructions, it is more likely a processor, and Article 28 governs that relationship instead. The test is factual: who decides why the personal data is processed and how. A contract label does not settle the question on its own. Where joint determination exists, the responsibilities must be set out in a transparent arrangement. The EDPB Guidelines 07/2020 explain how to apply the test, and counsel should confirm each role before drafting starts.

Who must sign a joint controller arrangement?

Each controller that shares responsibility for the processing should sign, through someone authorized to bind that organization. Article 26 requires the responsibilities to be determined transparently, but it does not prescribe signatories or a specific form. The EDPB Guidelines 07/2020 recommend a binding document. In practice, the signatories usually include the business owner of the processing and a legal representative, while security and privacy leads supply the technical annex. Confirm each party's internal signing authority early, because approvals across several organizations often take longer than the drafting itself.

How long does drafting a joint controller arrangement take?

No fixed duration applies, so ask each party for its own estimate. The main drivers are the number of joint controllers, the number of processing activities covered, and how much technical detail the annex needs, including security measures, breach workflows, sub-processors and transfers. Negotiation over which party leads on obligations and how liability is shared often takes the most time. Drafting is a one-time cost, but the arrangement must be reviewed whenever purposes, means or parties change, which is a recurring cost. DeployOpen works to a fixed scope agreed in writing before work starts, and a quote follows from that written scope.

Can a data subject still exercise rights against each joint controller?

Yes. Under Article 26(3), a data subject may exercise their rights against each controller, whatever the arrangement says between them. Article 26(2) also requires the essence of the arrangement to be made available to data subjects. The practical consequence is that every controller must be able to receive a request, verify it and either answer it or route it to the right party within the regulation's timelines. The arrangement should name a contact point and a forwarding procedure, and the teams running request intake in each organization need to follow it. Test that routing before go-live, not after the first complaint.

Can our team write and run a joint controller arrangement in-house?

Yes. Article 26 does not require outside help, and many teams draft the arrangement internally. The work depends on legal capacity, an accurate map of who decides what, and technical knowledge of where logs, backups and breach alerts sit. The arrangement is a living document, so it needs version control and clear edit rights. Tools such as XWiki keep page history and allow comparison and rollback, and BookStack lets administrators set permissions per page, although you should confirm both features in your deployed version. Legal wording remains a task for your counsel. A partner can prepare the systems and evidence behind the arrangement, but it does not write the legal position for you.

Who leads breach notification between joint controllers?

The arrangement should name one controller as lead for breach notification, and the EDPB Guidelines 9/2022 recommend stating this expressly. The lead should be the party with the strongest visibility of the affected systems, usually confirmed during the breach response exercise. The document should also set out how each controller passes alerts and facts to the lead, who decides on notifying the supervisory authority, who communicates with affected individuals, and who keeps the breach record. Test this workflow with a tabletop exercise, because gaps between controllers are most likely to appear during an incident, when clocks are already running.

What should we ask a partner before hiring one for this work?

Ask for a written scope before any commitment. The scope should be specific enough to show the processing activities, parties and arrangement clauses covered. Useful questions include:

Who reviews the legal wording, and how do they coordinate with your counsel?
Which deliverables are produced, such as technical annexes, data flow maps and evidence of security measures, and where those records are stored?
How are changes to the arrangement controlled after signing?
What does the partner not provide? DeployOpen prepares systems, controls and evidence for assessments, but independent auditors and certification bodies issue reports and certificates. DeployOpen's quotes follow from the written scope.

Primary sources for Article 26

Start with the text of Article 26 itself. The GDPR on EUR-Lex is the authoritative version, and the article is short enough to read in full before any guidance. Read paragraph 1 for the duty to set out, in a transparent arrangement, which party handles which obligations, with data subject rights and information duties named specifically. Read paragraphs 2 and 3 for two points that shape the arrangement: the essence of the agreement must be available to data subjects, and a data subject may exercise rights against each controller regardless of what the agreement says. Confirm the current consolidated text with your legal team before you rely on any quotation, because the article is the baseline every later decision refers back to.

The EDPB guidance is the next read. *EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR* recommends a binding document for the arrangement and lists what it should cover, including security measures, breach notification, DPIAs, the use of processors, third-country transfers and contacts with data subjects and supervisory authorities. Use that list as a checklist when you review a draft. For the breach point specifically, EDPB Guidelines 9/2022 on personal data breach notification (version 2.0) recommends that the arrangement name the controller that leads on breach notification. Ask your counsel or data protection officer to confirm whether the guidelines have been updated since you last reviewed them, and record the version you relied on in your file.

How DeployOpen prepares systems and evidence for joint controller arrangements

DeployOpen helps organizations prepare the systems, access controls and records that a joint controller arrangement depends on. The controllers keep ownership of the arrangement and its legal terms, and an implementation partner prepares the technical and documentary evidence behind it.

How we scope

Written scope names each joint processing activity, the parties involved and the systems that hold the shared personal data.
Scope records which party handles rights requests, notices, security and breach notification, drawn from the controllers' own decisions.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before any work starts.

How we build

Configure self-hosted platforms so each controller's access, logging and data flows match the responsibilities in the arrangement.
Set up shared request queues and ticket fields so rights requests reach the controller named as responsible without delay.
Test that access roles, audit trails and breach contact paths behave as the written arrangement describes before handover.

How we hand over

Document the configured controls, owners and evidence sources in version-controlled wiki pages with a change history.
Provide role and permission matrices that show which party can see, change and export shared personal data.
Deliver runbooks for passing data subject requests and breach information between controllers, with contacts confirmed by each party.

How we support

Ongoing support, upgrades and continuous security testing are available as retainers after handover.
Review the arrangement when processing, parties or systems change, and update documentation and configurations to match.
Confirm with your legal counsel and, where relevant, your data protection officer whether the arrangement terms are complete and accurate.