When a joint controller relationship is denied: what to do first
When the other party denies a joint controller relationship, do not argue the label first. Map who actually decides the purpose and the means of the processing, in writing. That evidence decides the question, not the position either side prefers. Send a dated notice setting out your reading of the facts, and start the clock on your own response obligations.
Why the label does not settle the question
A joint controller relationship is a description of a fact pattern, not a status either side gets to grant or withdraw by saying so. Under the applicable data protection framework, control follows from who sets the purpose of the processing and who fixes the means used to carry it out. A written denial from a counterparty changes nothing about that underlying fact pattern.
This is why a denial rarely ends a dispute. It shifts the argument from "are we joint controllers" to "what do the actual decision records show". Whoever holds better contemporaneous evidence of who decided what, and when, tends to hold the stronger position once a supervisory authority or a court is asked to look at the arrangement.
What changes once the relationship is denied
Once one side denies joint control, several things happen at once, and none of them wait for the dispute to resolve.
First, any transparency notice to data subjects that assumed a joint arrangement becomes inaccurate on its face, because it names a controller relationship the other side no longer accepts. Second, any data subject request already in flight has to be answered by somebody, and a denial does not pause the deadline for that answer. Third, if a supervisory authority has already been contacted, it will not wait for the parties to agree on labels before forming its own view of the facts.
The response deadline for a data subject request, or for a supervisory authority enquiry, is set by the applicable framework and starts running from the date the request or enquiry was received. A dispute over who is or is not a joint controller does not suspend that clock. Treat the deadline as live from day one, regardless of how the ownership question is eventually resolved.
What to do first
Work through this in order. Each step produces evidence the next step needs.
- Freeze the record. Pull the contract, the data flow diagrams, and any internal messages showing who proposed the purpose of the processing and who chose the tools or vendors used to carry it out.
- Identify who actually answers pending requests. If a data subject request or a regulator enquiry is already open, someone has to respond inside the applicable deadline, whether or not the controller question is settled.
- Put your position in writing to the other party. State plainly why you consider the arrangement to be joint control, and attach the evidence you have gathered.
- Ask for a written response within a stated period. A refusal to respond in writing is itself useful evidence if the matter escalates.
- Loop in whoever inside your organisation owns data protection compliance before you escalate externally. Internal sign-off avoids a second dispute about who spoke for your side.
- Prepare, but do not yet send, a complaint to the competent supervisory authority. Keep it ready in case the other party's denial is not resolved through direct correspondence.
Who decides, and on what evidence
Neither party gets the final word. The decision sits with whichever body is asked to rule on the underlying facts, and that body looks past the label both sides used at the time.
| Question | Who typically answers it first | Evidence that carries weight |
|---|---|---|
| Who set the purpose of the processing | The parties themselves, through correspondence | Emails, meeting notes, and drafting history showing whose objective the processing served |
| Who chose the means of the processing | Whoever operated or specified the systems used | Vendor contracts, technical specifications, and system access logs |
| Whether a transparency notice was accurate | The competent supervisory authority, on complaint | The notice itself, compared against the actual decision-making record |
| Final classification, if contested | The competent supervisory authority, or the courts on appeal | The complete record above, assessed as a whole rather than by label |
Neither an internal legal opinion nor a signed agreement stating "the parties are not joint controllers" is conclusive on its own. It is one piece of evidence, weighed against what the parties actually did.
Common scenarios
If the disputed arrangement sits inside a wider licensing agreement with a royalty stream attached, the same paperwork that fixes the royalty flow often fixes the processing purpose too. Read it together with the controller question rather than in isolation. See When withholding tax hits the royalty flow and its.
If the other party moved first to deny the relationship the moment you raised a concern, treat that as an opening tactical move rather than a settled position, in the same way a defendant filing a revocation action first is a tactic, not a resolution. See When the other side files revocation first and the.
If your underlying contract also contains a disputed limitation of liability clause, resolve the two disputes together. A denial of joint control often accompanies an attempt to narrow liability exposure at the same time. See When the customer refuses a limitation of liability in.
If personal data connected to the disputed arrangement is already being passed to third parties without your agreement, treat that as a separate and more urgent problem than the labelling dispute itself. See When secondary trading starts without consent step by step.
What this page does not resolve
This page sets out the first moves. It does not confirm your final status as a joint controller — that depends on facts specific to your arrangement, assessed against the applicable framework by a supervisory authority or a court. It does not set out cost or timing for a full dispute, and it does not replace a formal notice, complaint, or legal submission drafted for your specific facts.
Verified
Reviewed for currency as of the publication date shown on this page. This page describes a general procedural sequence under the applicable EU data protection framework. It does not cite a specific statutory provision, because no article-level reference for this exact question could be confirmed against our internal registry at the time of writing. Where a number, deadline length, or article reference becomes confirmable, this page will be updated to state it directly.
Related situations
A joint controller dispute often surfaces alongside disputes over how monitoring data is collected in the first place. See When an employee monitoring tool is deployed: what to.
FAQ
What is the first step when a joint controller relationship is denied?
Freeze the record before you argue the label. Gather the contract, the data flow documentation, and any correspondence showing who actually decided the purpose and the means of the processing. That evidence, not the denial itself, decides the question later.
Which deadline is already running?
Any response deadline tied to a pending data subject request or a supervisory authority enquiry keeps running regardless of the controller dispute. The applicable framework sets the length of that clock and starts it from the date the request or enquiry was received, not from the date the parties resolve their disagreement.
Who decides, and on what evidence?
The competent supervisory authority decides in the first instance, with courts available on appeal. Both look at contemporaneous evidence of who set the purpose and who chose the means of the processing, and they give little weight to a label chosen by either party after the fact.