GRCLibrary.ai

Template

Joint Controller Arrangement Template

This template defines the structure of a joint controller arrangement sufficient to satisfy GDPR Article 26 and equivalent obligations under UK GDPR. It also accommodates PIPL's joint-personal-information-handler concept (China, Article 20 joint personal information handlers). LGPD (Brazil) has no statutory GDPR-Article-26-style co-controller category or arrangement duty: Article 5(VI) defines the controller, and Article 42 section 1(II) instead makes controllers jointly and severally liable where they are directly involved in the processing from which the data subject's damage resulted, subject to the Article 43 exclusions. India's DPDPA recognizes joint determination only definitionally (Data Fiduciaries acting in conjunction with others, section 2(i)) and creates no statutory joint-controller arrangement. Adopting organizations populate one arrangement per joint-processing context.

Type
Template
Version
1.0.14
Date
2026-10-20
Owner
Data Protection Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Privacy
Review frequency
Annual and upon material change to the joint processing arrangement, joint controllers, or applicable privacy regime
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • Purpose
  • Scope
  • Field set
  • Use guidance
  • Framework alignment

Frameworks it maps to

Related documents