When multiple organizations process personal data together, GDPR requires clarity on who does what. A joint controller agreement formalizes these responsibilities, preventing the blame game when things go wrong. This guide provides a practical template you can adapt for your projects.
What Is a Joint Controller Agreement?
Under GDPR (Article 26), two or more controllers can determine the purposes and means of processing jointly. When this happens, they must establish “joint controllership” through a legal agreement. The agreement doesn’t reduce liability, each party remains responsible for compliance, but it defines internal responsibilities.
For developers, this often arises in scenarios like:
- Analytics platforms sharing data with third-party tools
- Multi-tenant SaaS applications processing data for different customers
- Mobile apps integrating SDKs that collect user data
- API integrations between services
Key Elements Required Under GDPR
Your joint controller agreement must include:
- Purpose of processing. What data you’re collecting and why
- Categories of data. Personal data types involved
- Data subjects. Whose data (customers, employees, etc.)
- Responsibilities matrix. Who handles what
- Data protection measures. Technical and organizational controls
- Sub-processor management. How you’ll handle vendors
- Breach notification procedures. Who notifies whom and when
- Contact points. How data subjects can reach you
Practical Template
Joint Controller Agreement
Effective Date - [DATE]
Parties - [Organization A] and [Organization B]
1. Purpose and Scope
This agreement governs the joint processing of personal data in connection with [PRODUCT/SERVICE NAME].
1.1 Purpose
The parties jointly determine the purposes and means of processing personal data for [specific use case].
1.2 Categories of Data
- Name, email, IP address
- [Other data types]
2. Responsibilities
| Task | Organization A | Organization B |
|------|----------------|----------------|
| Data Collection | Primary | Secondary |
| Data Storage | Primary | None |
| Security Measures | Primary | Secondary |
| Data Subject Requests | Shared | Shared |
| Breach Notification | Primary | Secondary |
2.1 Organization A Responsibilities
- Implement technical security measures
- Maintain processing records
- Handle data subject access requests
- Notify Organization B within 24 hours of any breach
2.2 Organization B Responsibilities
- Ensure lawful basis for data collection
- Support data subject requests within 5 business days
- Maintain adequate security for its systems
3. Data Protection Measures
Both parties implement:
- Encryption in transit (TLS 1.3)
- Encryption at rest (AES-256)
- Access controls and logging
- Regular security audits
4. Data Subject Rights
Both parties commit to responding to data subject requests within 30 days. For requests received by one party, that party will forward to the other within 48 hours.
5. Breach Notification
- Initial notification: within 24 hours of discovery
- Full report: within 72 hours
- Contact - [email@company.com]
6. Term and Termination
This agreement remains in effect for the duration of the data processing relationship. Upon termination, data must be returned or deleted within 30 days.
7. Governing Law
This agreement is governed by [jurisdiction] law.
Signed:
_________________ _________________
[Organization A] [Organization B]
Code Example - Mapping Responsibilities
For developers building tools that generate or manage these agreements, here’s a simple data structure:
const jointControllerAgreement = {
parties: [
{
name: "Acme Corp",
role: "primary",
responsibilities: [
"data_collection",
"secure_storage",
"breach_notification"
],
contact: "privacy@acme.com"
},
{
name: "Partner Inc",
role: "secondary",
responsibilities: [
"data_analysis",
"support_requests"
],
contact: "dpo@partner.com"
}
],
processing: {
purpose: "analytics_and_improvement",
categories: [guides],
legal_basis: "legitimate_interest"
},
timeline: {
breach_notification_hours: 24,
dsar_response_days: 30,
data_deletion_days: 30
}
};
Implementation Checklist
Before finalizing your agreement, verify:
- Each party has designated a privacy contact
- Data flows are documented (consider a data flow diagram)
- Security measures meet GDPR Article 32 requirements
- Sub-processor agreements are in place if using vendors
- Cross-border transfer mechanisms are specified (if applicable)
- Review cycle is established (annually recommended)
Common Pitfalls to Avoid
Vague responsibility definitions are a common problem. Avoid generic statements like “both parties ensure compliance” and be specific about who does what.
Missing breach procedures are another gap to watch for. GDPR requires notification within 72 hours of becoming aware of a breach, so specify exact timelines and communication channels in the agreement.
Third-party SDKs are easy to overlook. If you embed analytics or advertising SDKs, you may need to document whether you’re a joint controller with that vendor. Many SDKs have their own terms, review them carefully.
Automating Agreement Management
For larger organizations, consider storing these agreements in a structured format:
{
"agreement_id": "JCA-2026-001",
"status": "active",
"effective_date": "2026-01-01",
"review_date": "2027-01-01",
"parties": [...],
"data_processing": {...},
"last_updated": "2026-03-15"
}
This enables you to query active agreements, track expiration dates, and generate compliance reports programmatically.
Practical Implementation Workflows
For developers implementing these agreements, consider automating parts of the process:
Agreement Lifecycle Management
import json
from datetime import datetime, timedelta
class JointControllerAgreement:
def __init__(self, agreement_json):
self.data = json.loads(agreement_json)
self.last_reviewed = datetime.fromisoformat(
self.data.get('last_updated', '2026-01-01')
)
def is_review_due(self, months=12):
"""Check if agreement needs annual review"""
review_date = self.last_reviewed + timedelta(days=30*months)
return datetime.now() >= review_date
def get_active_processors(self):
"""Return list of active data processors"""
return [
p for p in self.data.get('processors', [])
if p.get('status') == 'active'
]
def validate_breach_notification_procedures(self):
"""Ensure breach procedures are documented"""
required_fields = [
'discovery_to_notification_hours',
'notification_contact',
'escalation_procedure'
]
procedures = self.data.get('breach_procedures', {})
return all(field in procedures for field in required_fields)
Data Flow Documentation
The most common audit failure is inadequate data flow documentation. Create visual diagrams:
Data Flow Diagram Example
Organization A → Personal Data Collection
↓
Encryption (AES-256)
↓
Organization B → Data Processing (Analytics)
↓
Temporary Storage (30 days)
↓
Deletion
Supervisory authorities expect clear documentation showing:
- What data flows between parties
- When data is encrypted
- How long data is retained
- Who has access at each step
Handling Sub-Processors
Many joint controller agreements overlook sub-processors, vendors that one controller engages without explicit agreement from the other controller. This is a compliance gap.
// Track sub-processor changes
const subProcessorRegistry = {
agreement_id: "JCA-2026-001",
processors: [
{
name: "AWS",
service: "S3 Storage",
started: "2026-01-01",
status: "active"
},
{
name: "Twilio",
service: "SMS Notifications",
added_date: "2026-02-15",
notification_sent: true // Did we notify the co-controller?
}
],
notifyCoController: function(processor) {
// 30-day advance notice required before adding new processor
const notification = {
date: new Date().toISOString(),
processor_name: processor.name,
processing_details: processor.service,
objection_deadline: new Date(Date.now() + 30*24*60*60*1000).toISOString()
};
return notification;
}
};
Dispute Resolution Procedures
The agreement should specify how co-controllers resolve disagreements:
Dispute Resolution (Add to Agreement)
Level 1 - Direct Discussion
If a dispute arises regarding interpretation or implementation:
1. Responsible party from each organization meets within 5 business days
2. Written summary of dispute circulated within 24 hours
3. Good faith negotiation occurs over 10-day period
Level 2 - Escalation
If unresolved after Level 1:
1. Executive sponsors meet
2. External mediator engaged if necessary
3. Decision documented in writing
Level 3 - Regulatory Review
If parties cannot agree:
1. Either party may request supervisory authority guidance
2. Both parties cooperate with investigation
3. Agreement may be suspended until resolved
Compliance During Mergers and Acquisitions
When a co-controller is acquired or merges, the joint controller agreement requires renegotiation:
// Track agreement status during M&A
const agreementStatusTracking = {
original_agreement_id: "JCA-2026-001",
merger_event: {
acquiring_party: "New Corp Inc",
merger_date: "2026-06-01",
notification_date: "2026-05-15",
status_options: [
"Continue with acquiring party as successor",
"Terminate and establish new agreement",
"Suspend pending integration review"
]
}
};
Regional Variations
Different jurisdictions impose additional requirements:
GDPR (EU) - The template above covers baseline requirements.
UK GDPR (Post-Brexit) - Nearly identical, but disputes may involve UK courts rather than CJEU.
CCPA (California) - US privacy law requires different contract language. “Joint controller” is not a standard term; use “co-discloser” terminology instead.
PIPEDA (Canada) - Canadian law requires explicit consent for joint processing; agreements must demonstrate opt-in consent collection.
Adapting agreements for different jurisdictions requires legal expertise, do not attempt multi-jurisdictional agreements without counsel.
When to Seek Legal Counsel
This template provides a starting point, but complex processing activities, cross-border data transfers, or high-risk processing may require professional legal advice. The ICO (in the UK) and other supervisory authorities provide guidance on joint controllership that complements this template.
Red flags requiring legal involvement:
- Processing involving biometric data
- Automated decision-making affecting legal rights
- Processing of criminal records or special category data
- Large-scale public monitoring
- Multiple cross-border data transfers
- Processing involving children’s data
A well-drafted joint controller agreement protects all parties and, more importantly, protects the data subjects whose information you’re handling. Take time to get it right, it’ll save headaches later and demonstrates commitment to privacy compliance.
Frequently Asked Questions
Who is this article written for?
This article is written for developers, technical professionals, and power users who want practical guidance. Whether you are evaluating options or implementing a solution, the information here focuses on real-world applicability rather than theoretical overviews.
How current is the information in this article?
We update articles regularly to reflect the latest changes. However, tools and platforms evolve quickly. Always verify specific feature availability and pricing directly on the official website before making purchasing decisions.
Are there free alternatives available?
Free alternatives exist for most tool categories, though they typically come with limitations on features, usage volume, or support. Open-source options can fill some gaps if you are willing to handle setup and maintenance yourself. Evaluate whether the time savings from a paid tool justify the cost for your situation.
How do I get started quickly?
Pick one tool from the options discussed and sign up for a free trial. Spend 30 minutes on a real task from your daily work rather than running through tutorials. Real usage reveals fit faster than feature comparisons.
What is the learning curve like?
Most tools discussed here can be used productively within a few hours. Mastering advanced features takes 1-2 weeks of regular use. Focus on the 20% of features that cover 80% of your needs first, then explore advanced capabilities as specific needs arise.
Related Articles
- GDPR Data Processing Agreement Template Guide
- Data Processing Agreement Template for Third Party Vendors
- Gdpr Controller Vs Processor Obligations Understanding Your
- GDPR Data Subject Access Request Template
- Data Retention Policy Template for Startups
- Claude vs ChatGPT for Drafting Gdpr Compliant Privacy
Built by theluckystrike. More at zovo.one