Joint Controller Agreement Template for New Zealand

A Joint Controller Agreement is a specialized contract that formalizes the relationship between two or more organizations that jointly determine the purposes and means of processing personal information. Under New Zealand's Privacy Act 2020, when multiple entities share control over data processing decisions, they must clearly define their respective roles, responsibilities, and obligations to ensure compliance with privacy principles and maintain accountability for data protection.

When do you need this document?

You need a Joint Controller Agreement when your organization collaborates with other entities in ways that involve shared decision-making about personal data processing. Common scenarios include joint ventures between companies that share customer databases, research collaborations between universities and private organizations that collect participant data together, marketing partnerships where multiple brands jointly process customer information for promotional activities, and consortium arrangements where member organizations contribute and access shared datasets. The agreement becomes legally necessary whenever you and another organization jointly determine not just what personal information to collect, but how it will be used, stored, and shared.

Key legal considerations

Your Joint Controller Agreement must clearly allocate responsibilities under the Privacy Act 2020's information privacy principles. Key provisions should address how you'll handle data subject access requests, ensuring either controller can respond effectively without creating confusion or delays. The agreement must establish comprehensive security measures that both parties will implement, including technical safeguards and staff training requirements. Breach notification procedures are critical - you need clear protocols for how either party will notify the other, affected individuals, and the Privacy Commissioner within required timeframes. The agreement should also address data retention periods, ensuring both controllers apply consistent policies, and establish procedures for data transfers, particularly if either party plans to send personal information overseas. Consider including dispute resolution mechanisms and termination procedures that protect personal information when the joint relationship ends.

Legal requirements in New Zealand

Under the Privacy Act 2020, joint controllers have equal responsibility for compliance with all 13 information privacy principles, regardless of which party initially collected the personal information. You must ensure your agreement addresses cross-border data transfer requirements if either controller operates internationally or uses overseas service providers. The agreement should incorporate the Privacy Act's definition of personal information and align with the agency's guidance on joint controllers issued by the Privacy Commissioner. New Zealand's Contract and Commercial Law Act 2017 governs the agreement's formation and enforceability, requiring clear terms and mutual consideration. Fair Trading Act 1986 obligations may apply if your joint processing involves consumer-facing activities, requiring transparent and accurate representations about data handling practices. Consider Consumer Guarantees Act 1993 implications if your joint processing supports services provided to consumers, as this may create additional accountability requirements.