Joint Controller

Joint controllership arises under GDPR Article 26 where two or more controllers jointly determine the purposes and means of personal data processing. The CJEU's case law (Wirtschaftsakademie, Jehovan todistajat, Fashion ID) has interpreted the concept broadly — a social-media operator and a website embedding a share-button can be joint controllers; an organisation and its ad-tech partner can be joint controllers for consent capture; two companies running a shared campaign can be joint controllers.

Article 26 requires joint controllers to agree, in a transparent manner, their respective responsibilities for complying with GDPR — in particular as regards data subject rights and the information duties under Articles 13 and 14. The essence of the arrangement must be made available to data subjects. Critically, data subjects may exercise their rights against either joint controller, so the allocation agreement is an internal distribution of responsibility, not a limitation on subject-facing accountability. The Norwegian DPA's 2 October 2026 €8.6 million fine against Xandr in the Grindr matter illustrated that each joint controller must independently verify that consent collected by the other is actually valid — joint controllership does not permit outsourcing accountability.