Short answer
Two organisations are joint controllers when each qualifies as a controller and they participate together in deciding the purposes and essential means of the same processing operation. Their decisions may be common or separate but converging; in the latter case, they must complement each other and each have a tangible impact on how and why the processing occurs. A contract saying “independent controllers” or “processor” cannot change the factual result. Nor are a formal agreement, equal influence or access to the personal data prerequisites.
They are independent controllers where each determines its own purposes and means for genuinely separate processing, even if data passes between them. An organisation is a processor where it processes only on another controller's behalf and documented instructions, although it may choose non-essential implementation details.
Joint control is operation-specific and does not make both parties responsible for an entire data lifecycle. Joint controllers must transparently allocate GDPR work, disclose the arrangement's essence and let people exercise rights against either controller. For compensatory liability, a responsible participant may have to pay the entire proven damage and then seek contribution from the others. Regulatory responsibility and fines still depend on the relevant infringement, each party's role and the circumstances.
The legal test is functional
The General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, has applied since 25 May 2018. Article 4 defines roles by conduct:
“‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;”
“‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;” —
Start with each processing operation—collection, transmission, analysis, storage or deletion—rather than the overall business relationship. Then ask who decided why that operation happens and its essential features: which data and people, which recipients, how long, and the key manner of processing.
The European Data Protection Board's non-binding distinguish essential means from technical or organisational choices a processor may make. Selecting software, hardware or detailed security measures within genuine instructions does not itself make a provider a controller.
When do decisions become joint?
Joint participation can arise through an express common decision. It can also arise from converging decisions, without one party dictating terms to the other. In Nacionalinis visuomenės sveikatos centras, Case C-683/21, the Court of Justice explained the threshold:
“where the latter is the case, those decisions must complement each other in such a manner that they each have a tangible impact on the determination of the purposes and means of the processing.” —
Commercial benefit, shared infrastructure or data exchange alone is not enough. The question is whether each actor exerts influence for its own purpose over the same operation's purpose and essential means. Each must independently satisfy the controller definition.
The case law supplies practical markers:
- In Wirtschaftsakademie, Case C-210/16, a fan-page administrator selected audience and activity parameters that influenced the platform's collection and statistical processing. Merely using a social network would not itself create joint control.
- In Jehovan todistajat, Case C-25/17, a community organised, coordinated and encouraged members' data collection for its own objective. It did not need access to the collected data or written processing instructions to participate in determining purposes and means.
- In IAB Europe, Case C-604/22, a sectoral organisation's binding technical and operational rules for recording consent preferences could give it tangible influence for its own purposes, despite no direct access to the strings concerned.
These examples do not make every page owner, association or standards body a joint controller.
Why the processing stage matters
Map the data journey into operations before assigning roles. In Fashion ID, Case C-40/17, a website embedded a social plugin that caused visitors' browsers to transmit data to the plugin provider. The website operator could participate in determining collection and transmission but not the provider's later use:
“a natural or legal person may be a controller … jointly with others only in respect of operations involving the processing of personal data for which it determines jointly the purposes and means.” —
The Court applied the same boundary in IAB Europe: influence over creating and sharing a consent-preference string did not automatically extend joint control to later targeted-advertising operations. A party may therefore be joint controller for collection, an independent controller for its separate analysis, and outside another party's later processing—all within one commercial system.
Independent controller or processor?
Two independent controllers decide separately why and how they process. A seller may disclose transaction data to a public authority under law; the authority then processes for its own statutory purpose. Sequential disclosure does not itself mean their decisions jointly determine one operation. The analysis changes if both design an integrated process for a shared or closely linked objective and each decision is necessary to its shape.
A processor serves the controller's interest. Article 28 requires a binding written arrangement, documented instructions, confidentiality, security, assistance, deletion or return, audit and subprocessor terms. A pre-designed service can still act “on behalf of” its customer. Article 28(10) treats a processor that determines purposes and means as a controller for that processing.
This distinction matters when a supplier wants to reuse customer data for product development, advertising or another independent purpose. That new purpose may make the supplier a controller for the reuse; it does not automatically turn the parties into joint controllers for every earlier operation.
What must joint controllers put in place?
Article 26 requires joint controllers to arrange transparently who handles GDPR obligations, especially notices and rights requests. The arrangement must reflect their real roles, its essence must be made available to data subjects, and it may name a contact point. The agreement follows the classification; its absence does not prevent joint control.
An operational allocation should cover lawful basis, transparency, data-subject requests, security, breach response, impact assessments, retention, processors, transfers, regulator cooperation and evidence of compliance. Allocation reduces gaps but does not remove external rights. Article 26(3) allows a person to exercise GDPR rights against each joint controller regardless of the arrangement.
What liability follows?
Three consequences should be separated.
First, supervisory authorities can investigate, order compliance, restrict processing and impose an administrative fine where its legal conditions are met. In Case C-683/21, the Court held that an Article 83 fine requires an intentional or negligent infringement. Joint status therefore does not create an automatic equal fine; the breached obligation, actual responsibility, fault and Article 83 factors matter.
Second, Article 82 compensation requires an infringement, material or non-material damage, and a causal link. The Court confirmed in Österreichische Post, Case C-300/21, that infringement alone is insufficient, although non-material damage has no minimum seriousness threshold.
Where several actors are involved in the same processing and responsible for the damage, the GDPR protects full recovery:
“each controller or processor shall be held liable for the entire damage in order to ensure effective compensation of the data subject.” —
The paying party may then recover from other involved controllers or processors the share corresponding to their responsibility under Article 82(5). Contractual indemnities can organise that recourse but cannot cut down the injured person's GDPR entitlement.
Third, a controller can face consequences for processing performed on its behalf by a processor, while a processor has direct GDPR duties and liability in specified circumstances. Case C-683/21 limits that controller exposure where the supplier acts for its own purposes or in a way incompatible with the controller's framework and beyond what the controller could reasonably be considered to have accepted. At that point Article 28(10) may classify the supplier as controller for the divergent processing.
A practical role-mapping checklist
- Split the system into specific processing operations and stages.
- Record each party's own purpose for every operation.
- Identify who decides data types, people, recipients, duration and essential methods.
- Test whether separate decisions complement each other and have tangible impact.
- Ask whether a supplier acts only on documented instructions and on the customer's behalf.
- Do not treat data access, a contract label or equal influence as decisive.
- Scope any joint-control finding to the operations actually determined together.
- Align Article 26 or Article 28 documents with reality, rights handling and incident response.
- Allocate internal recourse without suggesting that it removes external rights or regulatory powers.
Conclusion
Joint controllership arises from shared factual influence over the purposes and essential means of identified processing, whether through a common decision or complementary decisions with tangible impact. Independent purposes point to separate controllers; delegated processing within instructions points to a processor. The result must be mapped operation by operation. Joint controllers can divide compliance work and financial recourse, but people may exercise rights against either and may recover all proven damage from a responsible participant. Neither joint status nor a contract produces equal or unlimited responsibility for every stage.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.