Joint Controller Agreement Template for Germany

A Joint Controller Agreement is a legally binding document that governs the relationship between multiple organizations when they jointly determine the purposes and means of personal data processing. Under German law, this agreement is not optional but a mandatory requirement under Article 26 of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). You need this document whenever your organization shares control over data processing decisions with other entities, ensuring clear accountability and regulatory compliance in Germany's stringent data protection landscape.

When do you need this document?

You require a Joint Controller Agreement when your organization collaborates with other entities in ways that involve shared decision-making over personal data processing. Common scenarios include joint ventures where companies pool customer data for shared services, collaborative research projects between universities and corporations, shared technology platforms where multiple companies access the same user data, and marketing partnerships where organizations jointly process customer information. The agreement becomes essential when multiple parties have meaningful input into how personal data is collected, used, or shared, rather than one organization simply processing data on behalf of another.

Key legal considerations

Your Joint Controller Agreement must clearly define each party's specific responsibilities and liabilities under data protection law. The document should establish who handles data subject requests, manages security breaches, conducts data protection impact assessments, and maintains records of processing activities. You must ensure the agreement covers data retention periods, cross-border data transfers, and procedures for when the joint processing relationship ends. The contract should also specify how costs and liabilities are shared between controllers, particularly regarding potential regulatory fines and compensation claims. Clear communication protocols and decision-making procedures are essential to prevent conflicts and ensure swift responses to data protection issues.

Legal requirements in Germany

Under German law, your Joint Controller Agreement must comply with both European and national data protection requirements. The GDPR's Article 26 mandates that the agreement must be transparent and accurately reflect each controller's responsibilities toward data subjects. The Federal Data Protection Act (BDSG) adds specific German requirements, particularly regarding employee data protection and the role of data protection officers. You must ensure the agreement addresses the Telecommunications Telemedia Data Protection Act (TTDSG) if your joint processing involves electronic communications or online services. German supervisory authorities require that the agreement enables data subjects to exercise their rights effectively against either controller. The document must also comply with German contract law principles under the Civil Code (BGB), ensuring proper formation, validity, and enforceability of the contractual obligations between the joint controllers.