Controller To Controller Agreement Template for the Netherlands

When two organizations in the Netherlands need to share personal data while operating as independent data controllers, you require a Controller to Controller Agreement to ensure GDPR compliance. This legal document establishes the framework for lawful data sharing between entities that each maintain control over their own processing activities, distinguishing it from controller-processor relationships covered by separate agreements.

When do you need this document?

You need this agreement when your organization plans to share personal data with another company for mutual business purposes. Common scenarios include joint marketing campaigns where both companies use customer data for their own promotional activities, research collaborations between institutions sharing participant data, or business partnerships where customer information is exchanged for service delivery. The agreement is also essential when merging datasets for analytics purposes, sharing employee information during corporate restructuring, or collaborating on projects requiring access to each other's customer databases. Under Dutch law, any data sharing arrangement between independent controllers requires documented legal basis and clear allocation of responsibilities.

Key legal considerations

Your agreement must establish a lawful basis for processing under Article 6 of the GDPR, whether legitimate interest, contract performance, or consent. You need to clearly define the purpose limitation principle, specifying exactly why data is being shared and preventing use beyond agreed purposes. Data minimization clauses ensure only necessary data categories are exchanged, while accuracy provisions require both parties to maintain up-to-date information. Security measures must meet GDPR Article 32 requirements, including technical and organizational safeguards appropriate to the risk level. Breach notification procedures should establish timelines for informing each other and supervisory authorities within 72 hours. Data subject rights provisions must clarify how both controllers will handle access requests, corrections, deletions, and objections. International transfer clauses become critical if either party operates outside the EU, requiring adequate safeguards or Standard Contractual Clauses.

Legal requirements in Netherlands

Under the Dutch GDPR Implementation Act (UAVG), you must register your data processing activities with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if required by law. The agreement must comply with Dutch contract law under the Civil Code (Burgerlijk Wetboek), ensuring valid formation and enforceability. If telecommunications data is involved, additional requirements under the Dutch Telecommunications Act may apply. You need to designate Data Protection Officers if either organization meets the GDPR thresholds, and their contact details must be included in the agreement. Dutch law requires specific language regarding liability allocation between controllers, particularly for data protection violations and associated fines. The agreement should reference Dutch jurisdiction for dispute resolution and specify which party bears responsibility for data subject compensation claims under Article 82 of the GDPR.