Joint controller arrangement: what the decision maker looks at
A joint controller arrangement sets out how two organisations that jointly decide the purpose and means of processing personal data share responsibility toward the people whose data they process. The decision maker checks who drafted the document, whether both sides can point to a signed copy, and whether the split of duties matches what actually happens in the data flow, not what looks tidy on paper.
Practical consequence
When two organisations run overlapping data flows without a documented arrangement, each side carries exposure for the other's failures. A signed arrangement narrows that exposure to the tasks each party actually controls, but only if the split reflects operational reality. A document that assigns a duty to a party who has no technical means of carrying it out does not hold up under scrutiny.
Where the shared data underpins an asset used as security for financing, the arrangement should say so and point to the separate track that governs that asset. The process for Registration of a pledge over rights runs independently and does not substitute for controller documentation.
What to do
- List every processing activity both organisations touch, and mark who decides the purpose for each one. The operations lead does this, not the legal function.
- Draft a single document naming both organisations, the split of duties, and the contact point for data subjects. The person managing the underlying commercial relationship signs off on the draft.
- Send the draft to the other side's data protection contact and set a written deadline for confirmation.
- Publish a short notice describing the essence of the split — who does what — in a place data subjects can reach, usually on both organisations' privacy pages.
- File the signed arrangement with internal records and set a review date.
- Escalate to the compliance lead if the other side proposes a split that does not match the technical reality of the data flow.
Who decides
| Stage | Decision maker | Typical timing |
|---|---|---|
| Drafting | Operations lead, with the data protection contact | one to two weeks |
| Review | Compliance or legal function on each side | one to two weeks |
| Sign-off | Authorised signatory on each side | a few days |
| Escalation, if the sides disagree | Senior management of both organisations | varies with the size of the disagreement |
Forks
If the other side already has a template arrangement from an earlier project, start from theirs and mark every clause that does not match your data flow. Do not sign a document that describes a process your organisation does not actually run.
If a dispute already exists over who decided the purpose of processing, the position resembles a case where one side moved first and the other has to respond to an already fixed position. See When the other side moved first in this situation for the pattern that kind of disagreement tends to follow.
If the arrangement sits inside a technology contract that carries service levels, a delay in signing can trigger consequences under that contract before the arrangement itself is finished. The mechanics are covered separately in How service credit calculation technology contract what the decision.
If the shared data supports a token issuance programme, reporting obligations for that programme run on their own clock and do not wait for the controller arrangement to be signed. See Post-issue reporting step by step in practice for that separate timeline.
Limit
This page does not set out how long an arrangement must be, what liability split will hold up if tested, or how a specific clause will be read in a dispute. Those questions depend on the actual data flow and on the jurisdiction of each organisation involved, and they need a review of the document itself rather than a general description.
Verified
The procedure described above reflects common practice as checked against publicly available regulatory guidance current as of March 2025. No article numbers or act names appear on this page. The national rules that would support such citations are not yet mapped in our registry for this topic, and a procedural description does not need them to be useful.
FAQ
How long does joint controller arrangement take in practice?
Most arrangements take two to four weeks from first draft to signed copy, covering drafting, review by both compliance functions, and sign-off. It runs longer if the other side has no existing data protection contact to route the draft through.
Which documents are needed to start?
A map of the data flow, a contact list for both organisations' data protection function, and a first draft that splits duties by activity. Without the data flow map, the split tends to be guessed rather than accurate.
What happens if the other side does not respond?
Escalate through the existing commercial relationship and set a written deadline. If there is still no response, treat the processing as unresolved and flag it internally as an open risk until the arrangement is signed.
Related publications
For a related check on how internal controls are reviewed once systems are already running, see How internal audit of controls data protection what the.