What is a Joint Controller?
Two or more controllers are joint controllers when they jointly determine the purposes and means of processing of personal data (GDPR Article 26). Joint controllership triggers specific obligations: a transparent arrangement defining respective responsibilities, and disclosure of the essence of that arrangement to data subjects. The CJEU has interpreted joint controllership broadly (Fashion ID, Wirtschaftsakademie, Jehovan todistajat): fan-page operators, plugin embedders and co-branded campaigns can fall within scope.
When joint controllership arises
- Co-determination of purposes: both parties decide why processing occurs.
- Co-determination of essential means: categories of data, retention, recipients.
- Convergent decisions: CJEU C-25/17: even without a written agreement, factual convergence suffices.
Article 26 arrangement requirements
- Allocate transparency duties (Articles 13-14).
- Allocate data subject rights handling (Articles 15-22).
- Identify a single contact point (optional but recommended).
- Make the essence available to data subjects.
Joint controller vs. controller-processor
- Controller-processor: processor acts only on documented instructions; no shared purposes.
- Joint controllers: both decide purposes and essential means; both face data subject claims directly.
For Turkish operators
KVKK Article 3 defines “veri sorumlusu” without explicit “ortak veri sorumlusu” category, but Kurul kararları and academic literature treat shared purpose-and-means as triggering joint controller-equivalent duties. For EN-TR co-marketing, group company arrangements, or multi-platform integrations, KVKK and GDPR both require a documented allocation of responsibilities.
Do: document the joint arrangement, allocate transparency duties, and brief both teams on data subject request routing.
Don’t: assume a vendor contract converts a joint controller into a processor: the factual decision-making matters more than the label.
When two parties decide together, and what that requires
Joint controllership arises when two or more organisations jointly determine the purposes and means of a processing operation, not merely when they exchange data. Typical examples include co-branded campaigns, shared platforms, and research consortia where the partners design the processing together. The law requires joint controllers to set out, in a transparent arrangement, who is responsible for which obligation: in particular for providing information to data subjects and for handling their requests, and the essence of that arrangement should be made available to the individuals concerned. Critically, joint controllership does not let either party hide behind the other: a data subject can exercise their rights against any of the joint controllers, regardless of the internal allocation, which is why getting the arrangement and the public-facing notice right matters in practice.
Working on this? Vircon Legal advises on KVKK & GDPR Compliance and KVKK compliance guide. Talk to us →
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro call