Joint controller arrangement: stages and deadlines

A joint controller arrangement records who does what before two organisations start sharing personal data for a common purpose. The document itself does not remove either side's liability to the individuals involved. Its value is timing: signed before shared processing starts, it gives both sides a defensible split of duties. Signed afterwards, it only patches a gap that already existed while processing ran unallocated.

What changes once two sides process data together

Once two organisations jointly decide why and how personal data is processed, each stays fully answerable to the people affected, not only to each other. The arrangement does not change that external exposure. It fixes the internal split — who runs subject requests, who leads on a breach, who retains what — and gives affected individuals a single point of contact.

Until the arrangement is signed, both sides carry identical exposure without any internal split. Commercial teams tend to move faster than legal teams here. Processing frequently starts on the strength of a commercial agreement, on the assumption that the arrangement will catch up shortly. It rarely catches up on time, and the gap widens with every week of live processing.

Stages and what each one produces

1. Scoping call. Both legal teams confirm the processing is genuinely joint, not one side instructing the other. Output: a one-page confirmation of roles.
2. Draft allocation. The side holding the primary contact drafts who handles subject requests, breach notification, and retention. Output: first draft of the arrangement.
3. Internal sign-off. Each side clears the draft with its own data protection function. Output: mark-up returned within an agreed window.
4. Essence disclosure. The parts relevant to data subjects are prepared for publication or on-request disclosure.
5. Execution. Both sides sign. Processing started earlier is treated as retrospectively covered — a weaker position than starting after signature.
6. Review trigger. A date or event is fixed for revisiting the split, usually tied to a product change or a new data category.

The step most often skipped is the fourth. Teams sign an arrangement between themselves and forget that affected individuals are entitled to see its substance. That gap surfaces during a complaint, and is harder to close retroactively than to build in from the start.

What to do

• The data protection lead, not procurement, confirms joint control status first.
• Assign a single drafting owner in week one, so the document does not stall between two legal teams.
• Set a fixed turnaround for internal comments — five working days is realistic for most organisations.
• Prepare the subject-facing summary before processing goes live, not after.
• Sign before the first shared processing operation begins, not in parallel with it.

Who decides, and by when

No external body approves the arrangement before signature. The decision sits with the two organisations and their own data protection functions. A supervisory authority becomes involved only if an individual complains or a breach is notified, and it then reviews whichever allocation existed at the moment the incident occurred, not the version on file today. That is the practical deadline: the document must reflect reality at the moment something goes wrong, because that is the version examined.

If your situation differs

If the shared processing also touches a jointly built dataset with proprietary value, keep the data-sharing question and the rights question in separate documents. How registration of a pledge over rights IP licence runs on its own timeline and should not hold up signature of the controller arrangement.

If a vendor supplying infrastructure behind the joint processing refuses to accept liability for a breach on its side, resolve that separately from the arrangement itself. When a supplier refuses an indemnity: the deadline that applies there is usually shorter than the joint arrangement's own drafting window, and merging the two negotiations slows both down.

If the arrangement sits alongside service-level commitments between the two controllers, keep the credit mechanics in a referenced schedule rather than embedding them in the arrangement itself. Service credit calculation: stages and deadlines follows its own drafting logic, and mixing the two documents makes both harder to amend later.

What this page does not resolve

This page does not decide which side should hold primary contact — that depends on which organisation the affected individuals actually recognise, and is judged case by case. It does not cover a later finding that one side was in fact a processor rather than a joint controller; that reclassification changes the whole document and sits outside this procedure. It does not address reporting duties arising from unrelated regimes: organisations also managing token issuance should check Post-issue reporting step by step in detail as a separate procedure with its own deadlines.

Verified

Last checked: March 2025. This page describes a general procedural sequence drawn from published guidance issued by data protection authorities on shared processing arrangements. It does not cite specific statutory provisions, because the national implementing layer for this topic is tracked separately and is not yet complete for every jurisdiction covered by this site.

Related reading

Organisations that already run regular internal reviews of their data protection controls should fold the joint arrangement into that same review, rather than tracking it on its own calendar. How internal audit of controls data protection runs in sets out that review cycle in detail.

FAQ

How long does joint controller arrangement take in practice?

Most arrangements clear scoping, drafting and internal sign-off within three to six weeks when a single owner drives the draft. The timeline stretches when either side lacks a clear internal decision-maker, or when the essence disclosure is added late rather than drafted alongside the main text.

Which documents are needed to start?

A short confirmation that the processing is genuinely joint, a list of the data categories and purposes involved, and a note of which side already holds contact with the affected individuals. Without these three, drafting starts from an unclear premise and gets reopened later.

What happens if the other side does not respond?

Processing should not start while the split remains unresolved. A fixed internal deadline, escalated to a named decision-maker on each side rather than left with the drafting team, is what actually moves a stalled arrangement forward in practice.

Questions on a joint arrangement rarely arrive in isolation — they usually surface once processing is already live. Getting the sequence right before that point is the difference between a clean split and a retrospective patch.

— Rasa Tumenaite, AURELIS