Joint Data Controller Agreement Template for England and Wales

When your organization processes personal data jointly with another entity, you need a legally compliant framework that protects both parties and ensures regulatory compliance. A Joint Data Controller Agreement provides this essential legal structure under England and Wales law, establishing clear responsibilities and safeguarding your organization against data protection violations.

When do you need this document?

You require a Joint Data Controller Agreement whenever your organization shares decision-making power over personal data processing with another entity. This includes situations where you conduct joint marketing campaigns with business partners, operate shared customer databases, participate in collaborative research projects involving personal data, or establish joint ventures that process individual information. The agreement becomes mandatory when both organizations determine the purposes and means of data processing together, rather than one acting as a processor for the other. Without this agreement, you risk regulatory penalties and unclear liability allocation in case of data breaches or compliance failures.

Key legal considerations

Your Joint Data Controller Agreement must clearly define each party's specific responsibilities for UK GDPR compliance, including who handles data subject rights requests, breach notifications, and regulatory communications. The agreement should establish protocols for data sharing, security measures, and deletion procedures to ensure consistent data protection standards across both organizations. You need to address liability allocation between controllers, particularly for potential fines and compensation claims from data subjects. The document must specify how you will provide transparent information to data subjects about the joint processing arrangement, including which controller they should contact for exercising their rights. Additionally, ensure the agreement covers data transfer mechanisms if either party operates outside the UK, and establish clear procedures for handling disagreements or contract termination.

Legal requirements in England and Wales

Under UK GDPR Article 26 and the Data Protection Act 2018, joint controllers must have a binding arrangement that determines their respective responsibilities for compliance with data protection obligations. Your agreement must specify which controller will be responsible for fulfilling data subject rights, though individuals can exercise their rights against either controller. The ICO's Joint Controllers Guidelines require that you provide clear information to data subjects about the arrangement and their contact options. You must ensure the agreement addresses all aspects of joint processing activities and maintains appropriate technical and organizational security measures. The document should comply with ICO guidance on controller relationships and include provisions for regulatory cooperation during investigations or enforcement actions. Regular review of the agreement is essential to maintain compliance with evolving UK data protection legislation and ICO guidance updates.