Joint Controller Data Sharing Agreement Template for South Africa

A Joint Controller Data Sharing Agreement is a legally binding document that governs how two or more organizations share and process personal information when they jointly determine the purposes and means of such processing. Under South African law, this agreement is not just recommended but required under the Protection of Personal Information Act (POPIA) when organizations engage in joint data processing activities.

When do you need this document?

You need this agreement when your organization shares decision-making authority with other entities regarding personal information processing. Common scenarios include joint ventures where partners share customer databases, group companies processing employee data across subsidiaries, holding companies coordinating data activities with subsidiaries, and strategic partnerships involving shared marketing or research activities. The agreement is also essential when affiliated companies process personal information for mutual benefit, such as shared loyalty programs or integrated service delivery. If multiple organizations have equal say in determining how personal data is collected, used, or stored, POPIA mandates a formal joint controller arrangement.

Key legal considerations

The agreement must clearly allocate responsibilities between joint controllers, ensuring each party understands their obligations under POPIA. Critical elements include defining the scope of shared processing activities, establishing data security measures that meet POPIA's standards, and creating procedures for handling data subject requests such as access, correction, or deletion. You must also establish breach notification procedures that comply with POPIA's requirements, including timelines for notifying the Information Regulator and affected data subjects. Liability arrangements are crucial, as joint controllers can be held jointly and severally liable for POPIA violations. The agreement should specify how costs, damages, and regulatory penalties will be shared or allocated between parties.

Legal requirements in South Africa

Under POPIA, joint controllers must ensure their agreement addresses all eight lawful processing conditions, including accountability, processing limitation, purpose specification, and data quality. The agreement must demonstrate how both parties will implement appropriate technical and organizational measures to ensure data security. You're required to establish procedures for data subject rights enforcement, ensuring individuals can exercise their rights regardless of which joint controller they approach. The agreement must also comply with cross-border transfer restrictions if data sharing involves entities outside South Africa, requiring adequate protection measures or Information Regulator approval. Additionally, both parties must maintain processing records as required by POPIA Section 51, documenting their joint processing activities. The Constitution's Section 14 privacy rights must be respected throughout the arrangement, ensuring the agreement doesn't infringe on fundamental privacy protections.