Skip to content
DEEN

5,0/5 Google · 167 reviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.Period: October 2016 to date · As of: 12 November 2026

Have a joint controller agreement reviewed

A shared tool does not automatically make you a processor.

Where two companies jointly determine the purposes and means of processing, Art. 26 GDPR requires a transparent arrangement. We review the roles, draft or tighten the contract and distinguish the situation from a data processing agreement. You receive a documented basis for approval, cooperation and accountability.

Upload a draftArt. 26 arrangement, contract or process description, straight into the form.

Enquire without documents

The first contact is free of charge. Before any costs arise, we will tell you expressly.

Response on working days within 24 hours

As of: 12 November 2026

Schematic illustration of a typical Art. 26 arrangement. Clauses and markings are simplified and do not replace a review.

We review Art. 26 arrangements for

  • Shared platforms
  • Group and intra-group solutions
  • Joint campaigns
  • Co-marketing and events
  • Shared CRM or HR systems

Key points in brief

    For whom
    Companies that process data jointly with partners, group companies or platforms, or that want this reviewed.
    Result
    Role clarification, a draft contract or redlines, and a documented basis for approval.
    First contact
    free of charge, to clarify the topic, responsibility and next step
    Distinctions
    Not a substitute for a DPA, and no representation of data subjects.

    Reason for instruction

    What to do when two companies steer the same processing?

    The pressure typically arises when a shared system goes live, a partner presents a “joint controller agreement”, or the supervisory authority asks how tasks are divided.

    Joint controllership does not depend on the document title, but on who actually determines the purposes and essential means.

    A partner contract, a group policy or a platform’s terms of use can establish joint controllership, even if not every party itself accesses all the data. Equally often, a document is labelled “joint controller” even though one side only processes on instructions. That situation belongs in a DPA, not under Art. 26 GDPR.

    Typical occasion
    A shared platform, campaign, group system or a standard contract that has been presented.
    Risk
    The wrong role, incomplete information, unclear responsibility for requests.
    First question
    Who decides on the whether, the why and the essential means?
    Next step
    Establish the roles, allocate the duties, make the text robust.
    Shortly before the joint launch. The system is ready, the marketing line is agreed, but the contractual role is not. The reverse is also typical: a provider presents a joint controller agreement even though, on the actual service picture, it is a processor. We clarify both before you approve.

    Clarity on the role rather than a label on the cover

    The aim is a traceable allocation of duties and a contract that fits the actual cooperation. Where Art. 28 GDPR is the right basis, we say so openly and refer you to the package Data processing agreement.

    Review and implementation

    How do we clarify an Art. 26 situation in three steps?

    First we establish the role. Only then is it worth fine-tuning the contract text.

    1. Initial assessment

      You describe the cooperation and upload any existing drafts. We assess whether joint controllership, separate controllership or a processor relationship is the better fit.

    2. Offer

      Before work begins, we tell you the scope and costs transparently. Only then do you decide whether to instruct us.

    3. Arrangement

      We review or draft the text, prioritise open points and document the line on which you can approve or renegotiate.

    On the timetable. We agree the timetable with you before we begin. If you have a fixed deadline, for example a launch or a response period, tell us when you enquire.

    Service package

    What do we clarify and draft in the arrangement?

    Service package: agreement under Art. 26 GDPR

    1. Roles and decision-making picture

      We establish whether purposes and essential means are determined jointly, and distinguish that from acting on instructions, mere provision of a tool, and separate controllership.

    2. Allocation of duties

      We allocate information duties, data-subject rights, security, processors, third-country transfers and notification channels so that the arrangement remains workable internally.

    3. Transparency and documentation

      We formulate which essential content must be made available to data subjects, and record the reasons for the choice of roles in a traceable way.

    4. Contract text

      You receive a draft, redlines or a negotiation line, aligned with the actual cooperation and any existing main contracts.

    Area of law
    Data protection law, IT contract law
    For whom
    Companies that run joint processing with partners, group companies or platforms, or that want this reviewed.
    First response
    on working days within 24 hours
    First contact
    free of charge, to clarify the topic, responsibility and next step
    Costs
    We tell you the costs transparently before you instruct us. Only then do you decide.
    Result
    Role clarification, a draft contract or redlines, and a documented basis for approval
    Not included in the package
    Representing data subjects, proceedings before the supervisory authority, and negotiating with each of the other party’s sub-processors. That is a separate service, on request and as needed.
    Who provides what and who decides
    Your company
    • Describes the cooperation, provides contracts and decides on approval.
    The other party
    • Must agree to the choice of roles and to the text. Without agreement, the legal duty remains to classify the cooperation internally in a legally sound way nonetheless.

    ITMR

    • Reviews the role, drafts or tightens the arrangement and identifies open risks.
    Data protection and the business units
    • Supply the actual processes so that the contract fits in practice, not only on paper.
    How does the engagement work?
    1. First contact at no cost

      It is for classification, not yet for drafting the contract.

    2. Transparent offer

      Before we begin, we tell you the scope and costs. You then decide whether to instruct us.

    3. No hidden follow-on mandates

      Supervisory proceedings, a dispute with the partner, or a DPA are separate services and are only taken on after a separate agreement.

    Initial key questions

    Does joint controllership really exist?

    Before we draft clauses, we review the foundations. Many “joint controller” texts that are presented do not stand up to the actual decision-making structure.

    Purposes

    Who decides why the data are processed and which results are being sought?

    Essential means

    Who determines which data, which tools and which essential processes apply – not merely the technical operation?

    Access and use

    Joint controllership can exist even if one party does not itself access all the data.

    Document title

    The heading “DPA” or “joint controller” is not proof. What matters is who actually steers the processing.

    Typical case scenarios

    When does an Art. 26 review become commercially relevant?

    The constellations differ widely. We classify your case and examine where the real risk sits.

    Situation What typically needs to be clarified
    Shared platform or fan page Two companies jointly run a presence or a platform and determine which data are used for what.
    Group and intra-group solutions One company determines the purposes and essential means of a shared system; others use it and help steer it.
    Co-marketing, events, membership programmes Campaigns or events are jointly controlled, including lists, tracking or participant data.
    Standard contract presented A partner requires a signature on a joint controller agreement. We review whether that model fits the situation or a DPA is needed.
    A common misconception is that joint controllership requires equal data access or an even split of tasks. What matters is who jointly decides on the purposes and essential means. Conversely, not every exchange of data makes the parties joint controllers.

    Distinction from a data processing agreement

    When does the situation belong in a DPA rather than under Art. 26 GDPR?

    Art. 26 and Art. 28 GDPR typically exclude each other for the same relationship. The wrong basis leaves gaps in instructions, control and liability.

    Model Indicators
    Joint controllership (Art. 26) Purposes and essential means are determined jointly. A transparent arrangement is required, and each party must remain contactable for data subjects.
    Processing on behalf of a controller (Art. 28) One company processes on the other’s instructions. The right basis for that is a AVV: Have your data processing agreement (DPA) reviewed the right basis, not an Art. 26 agreement.
    Separate controllership Each company determines the purposes and means for its own part, for example in a mere exchange of data with each party using the data for its own purposes.

    Preparation

    Which documents speed up the review?

    A few documents are enough to start. The more precisely the actual decision-making structure is described, the more robust the choice of roles will be.

    Contracts and drafts
    • Any existing Art. 26 arrangement, partner or group contract, DPA, the platform’s terms of appointment, and the service description.
    Facts
    • A short account of who decides on purposes, tools, types of data and rules of use, and how requests from data subjects are handled today.

    Legal basis

    What does Art. 26 GDPR require of the parties?

    Where two or more controllers jointly determine the purposes and means of processing, they are joint controllers. In a transparent arrangement they must determine who fulfils which obligations under the GDPR. This applies in particular to the rights of data subjects and the information duties under Art. 13 and 14 GDPR. The essential content of the arrangement must be made available to data subjects. Regardless of the internal division, a data subject may exercise their rights against each of the controllers. The arrangement therefore does not release either party from its own responsibility, but it allocates practical responsibility and the cooperation.
    Sources
    • Art. 26 GDPR Joint controllers, the arrangement, transparency and the rights of data subjects.
    • Art. 28 GDPR Processing on behalf of a controller, as a contrast, where processing is carried out on instructions.
    • EDSA-Leitlinien Guidelines on distinguishing controller and processor and on joint controllership, for classifying typical constellations.

    Limits

    When another page is a better fit

    Not every data-protection situation is an Art. 26 case. We will tell you openly if the focus lies elsewhere.

    1. Processing on behalf of a controller

      If the other side processes on instructions, the case belongs to the package Data processing agreement.

    2. Stocktaking

      If an overview of processing activities and roles in the company is still missing, the better first step is often a Data protection audit or the Data protection set-up as the better starting point.

    3. Third-country transfers

      If a transfer to a third country is in the foreground, we address it specifically in the package International data transfers weiter.

    What makes approval unnecessarily risky

    • The arrangement is called “joint controller”, but the situation is a processor relationship – or the other way around.
    • Art. 13 and 14 GDPR are left unregulated, and data subjects are not given the essential content.
    • No one internally is responsible for handling data-subject rights on time.
    • TOMs, processors and notification of a breach are not allocated.
    • Mere membership of a group does not in itself establish joint controllership.
    • A partner template is signed without reviewing the actual decision-making structure.
    Your contactDominik Skornia, LL.B.

    Lawyer · AI-Privacy-Expert (GDDcert. EU) · External data protection officer

    View profile: Dominik Skornia Düsseldorf, Schirmerstraße 80 · Hamburg, Palmaille 124

    At ITMR, Jean Paul Bohne, Andreas Buchholz and Dr. Alexander Pleh hold the title of specialist lawyer for information technology law.

    Reviews

    What clients say

    5,0 von 5 · 167 Google reviewsPeriod: October 2016 to date · As of: 12 November 2026

    5,0 out of 5 · 71 reviews on anwalt.dePeriod: October 2018 to date · As of: 12 November 2026

    “We would like to thank you once again for your support in drafting the contract for the sale of software. Thanks to your advice, we were able to conclude a very good contract for us, with which we are extremely satisfied.” (translated from German)
    J. K. · anwalt.de (opens in a new tab) · 9 January 2026 · “Very good advice”
    “Great advice and service. Any time again.” (translated from German)
    T. D. · anwalt.de (opens in a new tab) · 5 August 2024 · “Top advice”
    “Mr Skornia took a lot of time and answered the questions on the GDPR rules in detail, competently and clearly. Happy to come back!” (translated from German)
    Katharina Ossenkop · Google

    FAQ

    Questions before approval

    When does joint controllership under Art. 26 GDPR exist?

    When two or more controllers jointly determine the purposes and the essential means of processing. What matters is actual decision-making power, not the title of a contract. Joint controllership can also exist without each party’s own access to all the data, if essential determinations are made jointly.

    How does an Art. 26 arrangement differ from a DPA?

    A DPA under Art. 28 GDPR concerns processing carried out on instructions by a processor. Art. 26 GDPR concerns controllers who jointly steer the processing. For the same relationship, as a rule only one of the two models is correct. Drawing that distinction is the first step of the review; the counterpart is our package Data processing agreement.

    Must data subjects be given the entire arrangement?

    The GDPR requires that they be given the essential content of the arrangement, not necessarily the full contract text. Which particulars are essential depends on the situation. We formulate this so that transparency and business secrets are placed in a robust relationship.

    Can data subjects approach only the party that is internally responsible?

    No. Regardless of the internal division, they may exercise their rights against each of the joint controllers. The arrangement is meant to steer handling internally, but it does not remove this statutory contactability. In this package, ITMR represents only the company, not data subjects as claimants.

    Is a platform provider’s standard contract enough?

    Only if it fits the actual allocation of roles and robustly reflects the statutory minimum content. Many standard texts are either too generic or choose the wrong model. We review this before approval and mark what must be renegotiated or documented internally.

    Does Art. 26 GDPR apply automatically in a group?

    No. Group companies may be joint controllers, separate controllers or processors. What remains decisive is who determines the purposes and essential means. A group policy can be an indication, but it does not replace a review of the specific processing.

    What is not included in the package?

    Representing data subjects, ongoing proceedings before the supervisory authority, and separately negotiating with all of the other party’s sub-processors. We offer such steps only after a separate agreement. We tell you the costs transparently before you instruct us.

    Is the first contact free of charge?

    It is for classifying the topic, responsibility and the next step. Before any costs arise, we will tell you expressly. Before work begins, you receive a transparent offer.

    Next step

    Align an Art. 26 case before approval becomes urgent

    Whether a shared platform, group system, campaign or a standard contract that has been presented: do not decide solely by the document title. Describe the cooperation. We get back to you within 24 hours on working days.

    Classify an Art. 26 case now

    Align joint controllership

    Your contact details

    Your message

    e.g. deadline from an Abmahnung (formal warning letter)

    Attach files

    Upload relevant documents (optional)

    FilesOptional

    Helpful are a draft of the arrangement, a description of the joint processing, existing DPAs or main contracts, and a short account of who determines purposes and means.

    Related services