# Joint Controller Arrangement Workflow Reference

## Joint Controllership Determination Workflow

1. **Identify the processing activity**: Describe the specific processing that involves two or more entities.
2. **Assess purpose determination**: For each entity, ask: "Does this entity influence WHY the data is processed?" Document the purpose each entity pursues.
3. **Assess means determination**: For each entity, ask: "Does this entity influence HOW the data is processed?" Focus on essential means (what data, how long, who accesses, security standards) rather than non-essential technical means (which software, which cloud provider).
4. **Apply the EDPB test**: Do two or more entities jointly determine purposes AND means, either through a common decision or converging decisions?
5. **Document the determination**: Record the analysis with reference to EDPB Guidelines 07/2020 and relevant CJEU case law.
6. **Outcome**: If joint controllership exists, proceed to arrangement negotiation. If not, determine whether the relationship is controller-processor (Art. 28) or separate controllers.

## Arrangement Negotiation Workflow

1. **Draft initial arrangement**: The lead controller (the party with the primary relationship to data subjects) prepares the initial draft using the template structure.
2. **Allocate responsibilities**: Both parties agree on who handles each GDPR obligation. Where responsibilities are shared, specify the division clearly.
3. **Designate contact point**: Agree on which entity serves as the data subject contact point. This entity must have procedures to forward requests to the other controller where needed.
4. **Address liability**: Include internal indemnification or contribution provisions. Note that these do not affect data subject rights under Art. 82(4).
5. **Legal review**: Both parties' legal teams review the arrangement for completeness, clarity, and alignment with their respective compliance frameworks.
6. **Execute arrangement**: Both parties sign the arrangement before joint processing begins.

## Data Subject Communication Workflow

1. **Prepare the essence summary**: Draft a plain-language summary of the arrangement covering: who the joint controllers are, what processing is covered, how responsibilities are divided, and how to contact the designated contact point.
2. **Publish the essence**: Include in the privacy notice of both controllers and/or as a standalone document accessible to data subjects.
3. **Update existing privacy notices**: Both controllers update their Art. 13/14 notices to reference the joint controllership and the other controller's identity.
4. **Train front-line staff**: Customer service and data protection teams at both controllers must understand the arrangement and how to handle data subject requests that involve the joint processing.

## Data Subject Rights Handling Workflow

When a data subject exercises rights related to joint processing:

1. **Receive request**: Either controller may receive the request (Art. 26(3) allows data subjects to contact any joint controller).
2. **Identify scope**: Determine whether the request relates to the joint processing or to processing that one controller handles independently.
3. **Route to designated contact**: If received by the non-designated controller, forward to the designated contact point within 48 hours.
4. **Coordinate response**: The designated contact coordinates with the other controller to gather necessary information.
5. **Respond within Art. 12 timelines**: One month from receipt by whichever controller received the request (not from the date of forwarding).
6. **Document**: Log the request in both controllers' DSAR registers, noting the joint processing context.

## Ongoing Governance Workflow

1. **Quarterly review meetings**: Joint controllers hold quarterly meetings to review the arrangement's effectiveness, data subject requests received, any incidents, and changes to processing.
2. **Change management**: Any proposed change to the joint processing (new data elements, new purposes, new recipients) must be agreed by both controllers and documented as an amendment to the arrangement.
3. **Incident coordination**: When a personal data breach affects joint processing, both controllers coordinate per the arrangement's breach management provisions. The designated controller notifies the supervisory authority per Art. 33.
4. **Annual arrangement review**: Formally review the arrangement annually to verify it remains accurate, responsibilities are being fulfilled, and the essence summary is current.
5. **Termination provisions**: If the joint processing ends, follow the termination provisions for data handling (return, deletion, or continued individual controllership).