What are joint controllers?
By Advisorn · updated on 25 October 2026 · Art. 5 let. j FADP, Art. 26 GDPR
In short
Joint controllers are two or more controllers that jointly determine the purpose and the means of a processing (Art. 5 let. j FADP, Art. 26 GDPR), for example two businesses that organise a joint event with a shared registration list. The FADP prescribes no contract, but it is advisable to settle who informs people and who answers requests; the GDPR requires an arrangement and that its essence be made available to data subjects.
Joint controller or processor?
Whoever processes the data only on your instructions and for your purposes is a processor, and a contract under Art. 9 FADP is needed. Whoever also uses it for their own purposes or decides with you how to process it is an independent controller or a joint controller.
What to settle
- who informs the people and with which privacy notice;
- who answers requests for access, rectification and erasure;
- who handles a breach and who notifies it;
- which security measures each one takes.
Related questions
Useful templates
General information, not advice on your case: for your case the text of the law prevails. For a question about your case there is Advisorn's consulting.