Joint Controller Agreement Template for Switzerland

When your organization collaborates with other entities to process personal data, you need a Joint Controller Agreement to establish clear legal responsibilities under Swiss law. This essential document defines how multiple organizations will share decision-making authority over data processing activities while ensuring compliance with the Swiss Federal Act on Data Protection (FADP) and maintaining Switzerland's EU adequacy status.

When do you need this document?

You require a Joint Controller Agreement whenever two or more organizations jointly determine the purposes and means of processing personal data. This applies to collaborative research projects between universities and corporations, joint marketing campaigns where companies share customer databases, shared service arrangements between group companies, or technology partnerships where multiple parties access and process the same personal data. The agreement is also essential when establishing joint ventures that involve customer data sharing, implementing shared IT systems that process employee or customer information, or creating industry consortiums that pool data for analysis. Without this agreement, you risk unclear liability allocation and potential compliance violations under Swiss data protection law.

Key legal considerations

Your Joint Controller Agreement must clearly define each party's specific responsibilities for data processing activities, including who handles data subject requests, breach notifications, and regulatory communications. The agreement should establish transparent arrangements for data subjects, ensuring they understand which controller is responsible for their personal data and how to exercise their rights. You must include detailed provisions for data security measures, incident response procedures, and liability allocation between controllers. The document should address cross-border data transfers, especially given Switzerland's adequacy status with the EU, and specify how controllers will coordinate responses to regulatory inquiries. Additionally, you need clear termination clauses that address data retention, deletion, or return when the joint processing relationship ends.

Legal requirements in Switzerland

Under Swiss FADP, joint controllers must ensure transparency by clearly informing data subjects about their shared responsibilities and providing accessible contact information for exercising rights. Your agreement must comply with Swiss data processing principles, including lawfulness, good faith, proportionality, and purpose limitation. You're required to maintain detailed records of processing activities and implement appropriate technical and organizational measures to protect personal data. The agreement must address the Swiss Federal Data Protection and Information Commissioner's (FDPIC) authority and establish procedures for handling regulatory inquiries. Given Switzerland's EU adequacy decision, your agreement should also consider GDPR Article 26 requirements to maintain seamless data flows with EU entities. You must ensure that data subject rights can be effectively exercised against either controller and establish clear mechanisms for handling complaints and disputes under Swiss law.