Skip to main content
Glossary termPublished inNormenkader IBP

Joint controllers

Also known as gezamenlijke verwerkingsverantwoordelijken, gezamenlijke verwerkingsverantwoordelijke

What are "joint controllers" under the GDPR?

Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information referred to in Articles 13 and 14, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject. The arrangement may designate a contact point for data subjects.

Defined in / by

Last updated: 14 October 2026.

Deciding together, answering together

The GDPR does not define joint controllers in Article 4. The term comes from the first sentence of Article 26(1), and the rest of the paragraph says what follows from it: the parties must set out in a transparent arrangement who handles which obligation, above all the data subject's rights and the information duties of Articles 13 and 14. The arrangement may name one contact point for data subjects.

Article 26(2) requires the arrangement to reflect the parties' real roles towards data subjects and its essence to be made available to them. Article 26(3) then removes the protection a neat division might seem to offer: whatever the arrangement says, the data subject may exercise his or her rights against each of the controllers.

In education the situation arises wherever schools and other bodies decide together. A samenwerkingsverband and its affiliated school boards that jointly set up how pupil support data are recorded and shared are a likely case. Whether a specific collaboration is joint control or two separate controllers exchanging data depends on who actually decides purposes and means, and that is a factual question for each processing.

Questions and answers

Do joint controllers need a written arrangement under the GDPR?

Article 26(1) of the GDPR requires joint controllers to determine their respective responsibilities by means of an arrangement between them, in a transparent manner, unless Union or Member State law already sets those responsibilities. The essence of the arrangement must be made available to data subjects under Article 26(2).

Can a data subject choose which joint controller to approach under the GDPR?

Yes. Article 26(3) of the GDPR lets the data subject exercise his or her rights in respect of and against each of the controllers, irrespective of the terms of their arrangement.

Regulations

  • Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)

    The Normenkader IBP is the Dutch framework of 69 information security and 25 privacy norms for primary, secondary and special education. Each school board must know where it stands by 1 January 2027 and meet maturity level 3 on every norm in 2030. It is a policy agreement, not an act.

    Next
    Every board knows its position against the Normenkader through a self-evaluation, and has a plan to meet all norms