Joint controllers are two or more entities that together decide why and how personal data is processed. GDPR Article 26 governs the relationship: they must enter into an arrangement (typically a contract) determining their respective responsibilities for compliance, particularly regarding data subject rights and information notices, and the essence of that arrangement must be made available to data subjects.
When does it arise
The classic case is a Facebook fan-page operator, established by the Wirtschaftsakademie Schleswig-Holstein judgment (CJEU 2018). The page operator and Facebook were held to be joint controllers of insights data because both decided, in some sense, what data was collected and why.
Modern examples:
- Co-branded campaigns where two companies decide together what data to collect and how to use it.
- Shared CRM databases between corporate group entities where each can act on the data for their own purposes.
- Industry data-sharing initiatives where members each contribute and benefit.
- Some advertising-tech relationships where the publisher and the ad network jointly decide on tracking.
It is not triggered just because two parties are involved in processing. A controller and processor are not joint controllers; the processor follows instructions and decides nothing on its own.
Why it matters
Joint controllership creates joint and several liability — a data subject can exercise their rights against either party, and a regulator can pursue either. The Article 26 arrangement is meant to clarify which party does what, but it does not limit the data subject's ability to choose who to approach.
In a vendor monitoring context, watch for vendors that quietly slide from "processor" to "joint controller" by introducing their own purposes. New language about "we may use aggregated data for industry benchmarks" or "we share data with our advertising partners" changes the relationship even if neither party renegotiates the contract. The privacy notice change is often the only place the transition is visible.