Description

The company may enter into a joint data controller agreement with one or more parties. This means that the company, together with one or more parties, is responsible for a processing operation and all parties have the right to use the collected information for their own purposes. Therefore, there is no joint data controller if a processing operation is only carried out for the purposes of one party.

A joint data controller agreement is important because this agreement can minimize the costs of designing the data processing. It is important that the joint data controllers enter into a transparent agreement in writing or similar, in which they determine their respective responsibilities for complying with the rules of the General Data Protection Regulation. This agreement must reflect the respective roles of the joint data controllers and their relationship with the data subjects.

Example of what such an agreement may contain:

Who are the parties
Joint data responsibility
Overall division of responsibility
Principles and processing authority
Rights of the data subjects
Security of processing and documentation of compliance with the General Data Protection Regulation
Use of data processors and sub-processors
List
Notification of personal data breaches to the supervisory authority
Notification of personal data breaches to the data subject
Data protection impact assessment and prior consultation
Transfer of personal data to third countries or international organisations
Complaints
Orientation of the other party
Regulation of other matters
Entry into force and termination