Joint controller arrangement: documents to prepare
When two or more organisations jointly decide why and how personal data is processed, five documents come first: a role-and-responsibility map, a draft arrangement text, a subject-contact-point notice, an internal sign-off record, and a shared processing inventory. Draft these before any data starts moving between the parties.
Practical consequence
Once processing starts without an agreed arrangement, both sides carry undivided responsibility for the same data. Regulators and data subjects do not need to work out who did what internally; they can address either party. Fixing the paperwork after the fact does not remove that exposure for the period it was missing.
Timing therefore matters more than polish. A short, clear document signed before launch protects both sides better than a long one signed after a complaint arrives. For a comparable case where multiple parties must agree on a shared document before a service starts, see How service credit calculation technology contract documents to prepare.
Delay also affects your negotiating position. The party that arrives with a drafted arrangement usually sets the terms; the party that waits usually accepts them. If your counterpart is slower than you, use the waiting period to finish your own draft rather than pausing work.
What to prepare
Each document below has a single owner and a single purpose. Splitting ownership between teams is the most common cause of delay at this stage.
| Document | Owner | Purpose |
|---|---|---|
| Role-and-responsibility map | Data protection lead | Records who decides what, and who answers which subject request |
| Draft arrangement text | Legal or contract owner | Sets out the agreed split in writing, ready for signature |
| Subject-contact-point notice | Communications or privacy team | Tells data subjects which party to approach first |
| Internal sign-off record | Both organisations, separately | Evidence that each side approved the final text internally |
| Shared processing inventory | Operations or IT | Lists systems, data categories and retention on both sides |
Build the inventory first. Everything else depends on knowing exactly which systems and data categories the arrangement has to cover. Organisations that already keep a register for other purposes, such as Registration of a pledge over rights, can reuse the same discipline: one file, one version, one owner.
Sign both organisations' internal records before either signature goes on the joint text. A joint document signed by one side only is not evidence of anything.
Who decides
The two organisations decide the content of the arrangement between themselves; no external body approves it in advance. A supervisory authority becomes involved only if a data subject complains or if an audit raises the question later, and at that point it reviews the arrangement as it existed at the time of the processing, not as it stands today.
Internally, sign-off sits with whoever holds data protection responsibility in each organisation. Where no such role exists yet, a senior manager from each side signs, and the arrangement should say so plainly rather than implying a title that does not exist.
Common scenarios
If you are the party proposing the arrangement, send a draft rather than a blank request for input. Counterparts respond faster to something they can mark up than to an open question.
If the other organisation sits outside your usual working relationship, expect the drafting stage to take longer. Build in a review round on each side before assuming a delay means refusal.
If a data subject request or complaint arrives before the arrangement is finished, answer the request on the usual internal timetable and finish the arrangement separately. Do not let an unfinished document become a reason to miss a request deadline. Where a dispute escalates further, the discipline around fixed dates resembles Preliminary injunction: stages and deadlines, where the calendar, not the paperwork, sets the pace.
What this page does not cover
This page does not draft the arrangement text itself, and it does not resolve disagreements between the two organisations about who bears which duty. It also does not cover data that has already been converted into a separate asset class with its own rules; questions of that kind belong under Classification in token issuance: definition and use rather than here.
It does not set a universal deadline either. How long the process takes depends on how many systems and teams sit on each side, and on how quickly each organisation's own sign-off moves.
Verified
Checked against internal registry entries and publicly available supervisory-authority guidance on 12 May 2025. No article numbers or act references appear on this page by design: the underlying national implementing texts are tracked separately and are cited only on pages built for that purpose.
Related reading
Organisations building this arrangement often review their own controls at the same time. See How internal audit of controls data protection documents to for the parallel checklist.
FAQ
How long does a joint controller arrangement take in practice?
Most take between two and six weeks once the processing inventory is complete. The main variable is how many internal sign-offs each organisation requires, not the length of the document itself.
Which documents are needed to start?
Start with the shared processing inventory. Without it, the role-and-responsibility map and the draft text both have to be rewritten once the real data flows become clear.
What happens if the other side does not respond?
Send a written reminder with a deadline, then proceed with your own internal documentation regardless. A one-sided arrangement is weaker evidence than a joint one, but it is better than no record at all while you wait.