Art. 26 GDPR · Chapter IV: Controller and processor · Section 1: General obligations
Article 26 GDPR: Joint controllers
Text as of 28 October 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the official text)
Where two or more controllers jointly determine the purposes and means of processing, they are joint controllers and must set out their respective responsibilities in an arrangement, the essence of which is made available to the data subject. The data subject may exercise his or her rights against each of the controllers.
Official text
Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information referred to in Articles 13 and 14, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject. The arrangement may designate a contact point for data subjects.
The arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects. The essence of the arrangement shall be made available to the data subject.
Irrespective of the terms of the arrangement referred to in paragraph 1, the data subject may exercise his or her rights under this Regulation in respect of and against each of the controllers.
Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu
Text as of 28 October 2026.
This is reference material, not legal advice.
Related recitals
This list is under review.
Court of Justice judgments
- C-492/23, X v Russmedia Digital SRL and Inform Media Press SRL
Judgment of 2 December 2025ECLI:EU:C:2025:935
An online marketplace operator is a controller of personal data in ads published on its site; before publication it must identify ads with sensitive data, check the advertiser is the person concerned or has explicit consent, take security measures against copying, and cannot rely on the hosting exemptions of the e-Commerce Directive for these GDPR duties.
- C-604/22, IAB Europe v Gegevensbeschermingsautoriteit
Judgment of 7 March 2024ECLI:EU:C:2024:214
A consent string recording a user's ad-tracking choices is personal data where it can reasonably be linked to an identifier such as an IP address; a sector body that sets binding rules for such strings can be a joint controller even without access to the data, but not automatically for later ad processing by others.
- C-231/22, État belge v Autorité de protection des données
Judgment of 11 January 2024ECLI:EU:C:2024:7
A body that runs a national official journal can be a controller of the personal data in what it publishes, even without legal personality, where national law sets the purposes and means; it may be responsible jointly with the bodies that send it the documents.
- C-683/21, Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos ministerijos v Valstybinė duomenų apsaugos inspekcija
Judgment of 5 December 2023ECLI:EU:C:2023:949
A body that commissioned an app and helped decide its purposes and means can be a controller without processing the data itself; joint control needs no formal arrangement; using real personal data to test software is processing; and a fine requires intent or negligence and can cover processing done by a processor on the controller's behalf.
- C-60/22, UZ v Bundesrepublik Deutschland
Judgment of 4 May 2023ECLI:EU:C:2023:373
A failure to conclude a joint-controller arrangement or keep a record of processing does not by itself make processing unlawful or give a right to erasure or restriction.
Related (earlier law or other instruments)
- C-40/17, Fashion ID GmbH & Co.KG v Verbraucherzentrale NRW eV
Judgment of 29 July 2019ECLI:EU:C:2019:629
Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)
A website that embeds a social plugin is a joint controller with the plugin provider for collecting and sending visitors' data, but only for that stage; each must pursue a legitimate interest, and the site must obtain any consent and give information for the stage it controls.
- C-25/17, Proceedings brought by Tietosuojavaltuutettu
Judgment of 10 July 2018ECLI:EU:C:2018:551
Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)
Notes taken by members of a religious community during door-to-door preaching are not a purely personal activity and can form a filing system; the community can be a controller jointly with its members even without access to the data.
- C-210/16, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH
Judgment of 5 June 2018ECLI:EU:C:2018:388
Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)
The administrator of a fan page on a social network is a controller jointly with the network; a supervisory authority can act against the network's local establishment in its own Member State.
EDPB guidance
- Guidelines 07/2020 on the concepts of controller and processor in the GDPR
EDPB 07/2020FinalFirst published 7 September 2020Final version 7 July 2021
- Guidelines 8/2020 on the targeting of social media users
EDPB 08/2020FinalFirst published 7 September 2020Final version 13 April 2021
Fines
Amounts are shown in the currency in which the fine was imposed.
- CRITEO: EUR 40,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 15 June 2023Appeal status: unknown
Ad-tech company could not show that the people whose browsing data it processed had consented, gave incomplete information, mishandled access, withdrawal and erasure requests, and lacked a proper joint-controller arrangement with partners.