Joint controllership with an agency or platform: Article 26 GDPR in practice

Joint controllership under Article 26 GDPR does not arise simply because an agency, marketplace or platform is involved in processing. The key question is whether several parties jointly determine the purposes and essential means. In practice, this can concern jointly planned campaigns, platform services or events with shared participant management.

This article focuses on a concrete cooperation between a business and an agency or platform. It explains how to identify joint decision-making, which points an Article 26 GDPR arrangement should cover and why a contract alone cannot replace an assessment of actual roles. The role check provides a first orientation for general role allocation.

Article 4(7) GDPR also covers several entities that jointly determine the purposes and means of processing. This does not require equal involvement in every detail. Joint controllership may arise where the business and the agency jointly set the audience, campaign objective, data selection or method of contact.

The contractual label is only one indication. The relevant question is who makes decisions in practice and which decisions materially affect the rights of data subjects. An agency providing a clearly defined technical service under instructions may be a processor. If it helps determine the purpose and audience of a joint activity, the arrangement needs a separate assessment.

Start with the actual processing operation. Which people are included, which data are used, what is the activity intended to achieve and through which platform or interface are the data processed? If both parties retain decisions on these points, joint controllership becomes more plausible.

Not every technical decision is an essential means decided jointly. A service provider may select hosting architecture or internal software components without determining the purpose. Data categories, audiences, retention, recipients and whether contact serves advertising, sales or event purposes are more closely linked to the rights of data subjects. Record the decision for each processing operation.

Article 26 GDPR requires a transparent arrangement allocating responsibilities. This includes information under Articles 13 and 14 GDPR, data subject requests, security incidents and contact routes. The full arrangement need not always be published, but its essential points must be made available to data subjects.

Specify who prepares the privacy notice, receives access, rectification, erasure or objection requests and involves the other party. Set internal forwarding times, documentation duties and complaint coordination. The arrangement should provide a clear contact and escalation route instead of referring generally to “shared obligations”.

Data subjects should understand who processes their data and for which purpose. This remains true if the cooperation is not visible in the background. A privacy notice should describe the parties and purpose in a way that can be understood. With a platform, clarify whether the business or platform operator uses messages, registrations or usage data for its own purposes. The overview of data subject rights and access supports the organisational handling of requests.

Avoid contradictory information. If an agency relies on consent while the business states a legitimate interest, purpose, data scope and legal basis must be reviewed together. Retention, recipients and transfers outside the EEA should also match across documents.

An Article 26 arrangement allocates tasks between joint controllers. It may state who is the first contact for access, rectification, erasure or objection. It should not prevent a data subject from exercising a right because the parties disagree internally. Each party remains generally approachable by data subjects.

For incidents, define who reports a suspected personal data breach, which information is shared immediately and who coordinates the risk assessment. The section on data breaches and notification duties explains the next organisational steps. Contractual allocation does not remove each party’s duty to identify and respond to an incident.

An agency or platform may pursue its own purposes alongside the joint processing. Examples include its own invoicing, system security, account administration or independent product analytics. It may be a sole controller for that part. This must be separated from the joint campaign or service.

Broad clauses allowing all data to be used for “optimisation” are risky. Assess scope, purpose, legal basis, retention and recipients separately. If the provider is a processor for one part and a controller or joint controller for another, the data flows and settings should support that separation. The information on processors and service providers helps with the distinction.

The arrangement must match actual platform use. Check whether new functions, subprocessors, tracking elements or shared audiences have been added since signature. A campaign change can alter purposes and means enough to require a new role assessment.

Record approvals, versions and changes. A short role matrix can show who determines purpose, data categories, recipients, retention, deletion and data subject contact. For complex campaigns, also assign control of exports, access rights and deletion runs. The privacy governance and compliance page supports the organisational implementation.

A common mistake is to equate participation with joint controllership. A party that technically transfers data or operates a platform does not automatically jointly determine the purpose. Conversely, an agency may be a joint controller even if it does not perform every technical step.

Unclear contact routes, conflicting privacy notices and arrangements without a change process create further risk. Check whether the parties can actually forward incidents within the agreed time. A list of responsibilities without reachable contacts and access to the required information will not work in practice.

Joint event: A business and event agency jointly determine the audience, registration form and communication purpose. Joint controllership may be appropriate for registration. The agency may separately be a processor for mailing or hosting if it follows instructions for that part.

Marketplace: A retailer uses a platform. Different roles may apply to sales processing, account administration and security. A separate assessment is needed for jointly determined advertising or offer functions.

Advertising campaign: A business and agency jointly define audience, data sources and contact sequence. It is not enough to label the agency a processor for everything. Each data flow must align purpose, means, transparency and responsibility.

The contract is rarely enough on its own. Collect briefs, campaign approvals, forms, platform descriptions, role and access concepts and the current privacy notice. Also gather information on recipients, retention, subprocessors and transfers outside the European Economic Area. These materials often show more clearly who actually made each decision.

Assign the documents to the specific processing operation. A general agency agreement may cover several projects with different data flows. For each campaign or platform function, record the audience, fields collected, approval route and how data are deleted or returned at the end. This prevents an abstract contractual label from hiding the actual cooperation.

Finally compare internal processes with public information. The Article 26 GDPR arrangement, privacy notice and form should describe the same purpose, parties and contact route. Record version changes and obtain approval from the responsible people. For recurring campaigns, carry out a short annual comparison and an additional review when new functions or providers are introduced.

If the agency or platform already uses its own templates and standard wording, do not adopt them without review. Ask which data are reused for independent purposes and which settings the business can control itself. These details often determine whether the arrangement reflects actual joint decision-making and adequately supports the rights of data subjects.

In agency and platform models, the decisive questions usually concern actual cooperation: who determines the audience, data flow, access, retention and contact route? We assess the roles, the Article 26 GDPR arrangement and its consistency with privacy notices and internal processes. Please provide the arrangement, a description of the platform or campaign and the information given to data subjects so that the next steps can be defined.