We run a campaign with a partner and share customer data. Does that make us joint controllers?

Not automatically. Paragraph 1 says you are joint controllers if you jointly determine the purposes and means of the processing. Sharing data by itself is not decisive; assess who decides why the data are processed and how. If you decide that together, you must put an arrangement in place.

What must the arrangement contain at a minimum?

Paragraph 1 requires a transparent allocation of responsibilities, in particular who handles data subject rights and who provides the information under Articles 13 and 14; you may also designate a contact point for data subjects. Paragraph 2 requires the arrangement to clearly reflect the role of each party and its relationship with data subjects. You must make the essence of it available to data subjects (paragraph 2).

A data subject sends an access request to us, although the agreement is that our partner handles those. Can we refer them on?

Paragraph 3 says the data subject may exercise their rights against each of the controllers, irrespective of the terms of the arrangement. The request is therefore validly submitted to you and you cannot reject it by pointing to the agreement. Internally you may have your partner handle it, as long as the data subject is not affected by that and the request is answered.

Article 26: Joint controllers

Praxikon tracks Article 26 (Joint controllers) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IVIn force since 25-05-2018

Article 26 sets out what must happen when two or more organisations jointly decide why and how personal data are processed. They are then joint controllers and must, in an arrangement between them, transparently determine who fulfils which obligation under the GDPR, in particular regarding the rights of data subjects and the information duties of Articles 13 and 14 (paragraph 1). That arrangement must clearly reflect the role of each party and its relationship with the data subjects, and the essence of the arrangement is made available to data subjects (paragraph 2). Whatever the parties agree, you as a data subject can exercise your rights against each of them (paragraph 3). The article exists because responsibilities must be clearly allocated, even when several parties share control, otherwise nobody can be held to account (recital 79).

Key term: Joint controllers: two or more organisations that together determine the purposes and means of a processing operation and are therefore jointly responsible

Directly affects:controllerdata subject

Praxikon’s reading of the text and the recitals; the official text below prevails.

Official text

Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information referred to in Articles 13 and 14, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject. The arrangement may designate a contact point for data subjects.

The arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects. The essence of the arrangement shall be made available to the data subject.

Irrespective of the terms of the arrangement referred to in paragraph 1, the data subject may exercise his or her rights under this Regulation in respect of and against each of the controllers.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

Check whether you determine the purposes and means of a processing operation together with another organisation, because then you are joint controllers (paragraph 1). Record in an arrangement between you who informs data subjects under Articles 13 and 14, who handles data subject requests and who fulfils which other obligation, unless a legal provision already allocates this (paragraph 1). Make the essence of that arrangement available to data subjects and bear in mind that a data subject may still turn to any of the parties (paragraphs 2 and 3).

Data Subject

If several organisations are jointly responsible for your data, you are entitled to the essence of their mutual arrangement (paragraph 2). You can exercise your rights against each of those organisations, regardless of what they have agreed among themselves (paragraph 3).

Compliance checklist

For every processing operation with another organisation, it has been assessed whether the purposes and means are determined jointly (paragraph 1).An arrangement has been recorded with each joint controller, unless a provision of Union or national law already allocates the responsibilities (paragraph 1).The arrangement names who provides the information under Articles 13 and 14 to data subjects (paragraph 1).The arrangement names who handles data subject requests concerning their rights and, where desired, a contact point for data subjects (paragraph 1).The arrangement clearly reflects the role of each party and how each party relates to the data subjects (paragraph 2).The essence of the arrangement is available to data subjects, for example in the privacy notice (paragraph 2).Data subject requests are taken up, even where the arrangement designates another party to handle them (paragraph 3).

Related recitals

(79)

The protection of the rights and freedoms of data subjects as well as the responsibility and liability of controllers and processors, also in relation to the monitoring by and measures of supervisory ...

(80)

Where a controller or a processor not established in the Union is processing personal data of data subjects who are in the Union whose processing activities are related to the offering of goods or ser...

(81)

To ensure compliance with the requirements of this Regulation in respect of the processing to be carried out by the processor on behalf of the controller, when entrusting a processor with processing a...

(82)

In order to demonstrate compliance with this Regulation, the controller or processor should maintain records of processing activities under its responsibility. Each controller and processor should be ...

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Case law (6)

11 January 2024 · C-231/22 · CJEU
État belge (Moniteur belge)
An official journal can be a controller where national law determines the purposes and means of publication. It is then itself responsible for the Article 5 principles, unless national law creates joint responsibility.
5 December 2023 · C-683/21 · CJEU
Nacionalinis visuomenės sveikatos centras
Whoever commissions an app and helps decide purposes and means can be a controller without processing data itself. Joint controllership does not require an arrangement between the parties, and a fine requires intent or negligence.
4 May 2023 · C-60/22 · CJEU
UZ v Bundesrepublik Deutschland
The absence of a joint controller arrangement or of a record of processing does not in itself make processing unlawful, so it gives no right to erasure or restriction.
29 July 2019 · C-40/17 · CJEUDirective 95/46
Fashion ID
A website embedding a Facebook button is a joint controller, but only for collecting and transmitting visitor data. Consumer associations may bring proceedings on behalf of data subjects.
10 July 2018 · C-25/17 · CJEUDirective 95/46
Jehovan todistajat
Notes taken by members of a religious community during door-to-door preaching are not a household activity and can form a filing system. The community is a joint controller with its members, even without access to the data itself.

Show 1 more

5 June 2018 · C-210/16 · CJEUDirective 95/46
Wirtschaftsakademie
The administrator of a Facebook fan page is a controller together with Facebook. A Member State's supervisory authority may act against the group's establishment on its territory.

Guidelines (1)

13 April 2021 · v2.1 · EDPB
Guidelines 8/2020 on the targeting of social media users
Describes the roles and responsibilities of social media platforms and advertisers in targeted advertising and the legal bases that fit.

Line of case lawWho is the controller?

When are you a (joint) controller?

Google Spain (2014)A search engine is responsible for its own processing of others' publications.
Wirtschaftsakademie (2018)A fan page administrator is responsible together with Facebook.
Jehovan todistajat (2018)An organisation steering processing is jointly responsible, even without access to the data.
Fashion ID (2019)Joint responsibility applies per stage of processing.
Guidelines 07/2020 on the concepts of controller and processor in the GDPR (2021)The EDPB sets out the criteria for controller and processor.
Nacionalinis visuomenės sveikatos centras (2023)Whoever commissions an app and sets its purposes is responsible without processing data itself.
IAB Europe (2024)An industry body imposing a standard can be jointly responsible.
Russmedia Digital (2025)An online marketplace is responsible for personal data in advertisements.

Checked on 5 November 2026

Frequently asked questions

← Art. 25: Data protection by design and by default Art. 27: Representatives of controllers or processors not established in the Union →

Connections

Case law

IAB Europe: the TC String is personal data and the industry body is a joint controller
2024-03-07 · final, Hof van Justitie van de EU (Vierde kamer), IAB Europe tegen Gegevensbeschermingsautoriteit (België)
Russmedia: an online marketplace operator is controller for personal data in adverts and must check before publication
2025-12-02 · final, Hof van Justitie van de EU (Grote kamer), X tegen Russmedia Digital SRL en Inform Media Press SRL

Guidelines

Guidelines 07/2020 on the concepts of controller and processor in the GDPR
2021-07-07 · final, European Data Protection Board (EDPB)
Guidelines 02/2025 on processing of personal data through blockchain technologies
2026-07-07 · final, European Data Protection Board (EDPB)