--- title: "Art. 26 GDPR: Joint controllers" canonical: "https://dposchool.com/gdpr/article/26" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_26" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 26 GDPR · Chapter IV: Controller and processor · Section 1: General obligations # Article 26 GDPR: Joint controllers Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) Where two or more controllers jointly determine the purposes and means of processing, they are joint controllers and must set out their respective responsibilities in an arrangement, the essence of which is made available to the data subject. The data subject may exercise his or her rights against each of the controllers. ## Official text ### Article 26(1) **1.** Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information referred to in Articles 13 and 14, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject. The arrangement may designate a contact point for data subjects. ### Article 26(2) **2.** The arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects. The essence of the arrangement shall be made available to the data subject. ### Article 26(3) **3.** Irrespective of the terms of the arrangement referred to in paragraph 1, the data subject may exercise his or her rights under this Regulation in respect of and against each of the controllers. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 26 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_26) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 79](https://dposchool.com/gdpr/recital/79) ## Court of Justice judgments ### [C-492/23, X v Russmedia Digital SRL and Inform Media Press SRL](https://dposchool.com/gdpr/case/c-492-23) Judgment of 2 December 2025 · ECLI:EU:C:2025:935 An online marketplace operator is a controller of personal data in ads published on its site; before publication it must identify ads with sensitive data, check the advertiser is the person concerned or has explicit consent, take security measures against copying, and cannot rely on the hosting exemptions of the e-Commerce Directive for these GDPR duties. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-492/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0492) ### [C-604/22, IAB Europe v Gegevensbeschermingsautoriteit](https://dposchool.com/gdpr/case/c-604-22) Judgment of 7 March 2024 · ECLI:EU:C:2024:214 A consent string recording a user's ad-tracking choices is personal data where it can reasonably be linked to an identifier such as an IP address; a sector body that sets binding rules for such strings can be a joint controller even without access to the data, but not automatically for later ad processing by others. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-604/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0604) ### [C-231/22, État belge v Autorité de protection des données](https://dposchool.com/gdpr/case/c-231-22) Judgment of 11 January 2024 · ECLI:EU:C:2024:7 A body that runs a national official journal can be a controller of the personal data in what it publishes, even without legal personality, where national law sets the purposes and means; it may be responsible jointly with the bodies that send it the documents. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-231/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0231) ### [C-683/21, Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos ministerijos v Valstybinė duomenų apsaugos inspekcija](https://dposchool.com/gdpr/case/c-683-21) Judgment of 5 December 2023 · ECLI:EU:C:2023:949 A body that commissioned an app and helped decide its purposes and means can be a controller without processing the data itself; joint control needs no formal arrangement; using real personal data to test software is processing; and a fine requires intent or negligence and can cover processing done by a processor on the controller's behalf. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-683/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0683) ### [C-60/22, UZ v Bundesrepublik Deutschland](https://dposchool.com/gdpr/case/c-60-22) Judgment of 4 May 2023 · ECLI:EU:C:2023:373 A failure to conclude a joint-controller arrangement or keep a record of processing does not by itself make processing unlawful or give a right to erasure or restriction. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-60/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0060) ### Related (earlier law or other instruments) #### [C-40/17, Fashion ID GmbH & Co.KG v Verbraucherzentrale NRW eV](https://dposchool.com/gdpr/case/c-40-17) Judgment of 29 July 2019 · ECLI:EU:C:2019:629 Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR) A website that embeds a social plugin is a joint controller with the plugin provider for collecting and sending visitors' data, but only for that stage; each must pursue a legitimate interest, and the site must obtain any consent and give information for the stage it controls. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-40/17&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0040) #### [C-25/17, Proceedings brought by Tietosuojavaltuutettu](https://dposchool.com/gdpr/case/c-25-17) Judgment of 10 July 2018 · ECLI:EU:C:2018:551 Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR) Notes taken by members of a religious community during door-to-door preaching are not a purely personal activity and can form a filing system; the community can be a controller jointly with its members even without access to the data. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-25/17&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0025) #### [C-210/16, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH](https://dposchool.com/gdpr/case/c-210-16) Judgment of 5 June 2018 · ECLI:EU:C:2018:388 Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR) The administrator of a fan page on a social network is a controller jointly with the network; a supervisory authority can act against the network's local establishment in its own Member State. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-210/16&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62016CJ0210) ## EDPB guidance ### [Guidelines 07/2020 on the concepts of controller and processor in the GDPR](https://dposchool.com/gdpr/guidance/edpb-07-2020) EDPB 07/2020 · Final · First published 7 September 2020 · Final version 7 July 2021 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-072020-on-the-concepts-of-controller-and-processor-in-the-gdpr_en) ### [Guidelines 8/2020 on the targeting of social media users](https://dposchool.com/gdpr/guidance/edpb-08-2020) EDPB 08/2020 · Final · First published 7 September 2020 · Final version 13 April 2021 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-82020-on-the-targeting-of-social-media-users_en) ## Fines Amounts are shown in the currency in which the fine was imposed. ### [CRITEO: EUR 40,000,000](https://dposchool.com/gdpr/fine/cnil-criteo-2023-06) Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 15 June 2023 · Appeal status: unknown Ad-tech company could not show that the people whose browsing data it processed had consented, gave incomplete information, mishandled access, withdrawal and erasure requests, and lacked a proper joint-controller arrangement with partners. [Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000047707063) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter IV](https://dposchool.com/gdpr/chapter/4) / Article 26 Previous: [Art. 25 GDPR: Data protection by design and by default](https://dposchool.com/gdpr/article/25) Next: [Art. 27 GDPR: Representatives of controllers or processors not established in the Union](https://dposchool.com/gdpr/article/27) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents