---
title: "Split the duties in writing with joint · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/processors-and-transfers/joint-controllers
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Split the duties in writing with joint controllers

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Processors and transfers](https://agentwranglers.se/playbook/compliance/processors-and-transfers.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- ID: CMP-68
- Level: Required
- Chapter: [Processors and transfers](https://agentwranglers.se/playbook/compliance/processors-and-transfers)
- Rule: When you and another company decide together why and how personal data is used, sign an arrangement that splits the GDPR duties. Show its essence to the people affected.
- Risk: A law broken
- Applies when: The project has users in the EU.
- How: GDPR Article 26 makes you joint controllers. Common cases are a co-branded product, a shared loyalty scheme, or a social media plugin that sends visitor data to its owner. On a website, load such plugins only after a click, as [load embedded videos and maps only after a click](https://agentwranglers.se/playbook/website/privacy/click-to-load-embeds) says. The arrangement says who answers data requests, who gives the privacy notice and who reports breaches. It may name one contact point for people. People can still use their rights against either of you, whatever the arrangement says. Record each partner in the [vendor register](https://agentwranglers.se/playbook/compliance/processors-and-transfers/vendor-register) with the role `joint_controller`. Link it from the [record of processing](https://agentwranglers.se/playbook/compliance/records-and-data-map/records-of-processing). A vendor that only follows your instructions is a processor and needs an [Article 28 agreement](https://agentwranglers.se/playbook/compliance/processors-and-transfers/dpa-article-28) instead.
- Check: The build fails when a register entry with the role `joint_controller` lacks an arrangement link or an owner for data requests, notices and breaches. A test fetches the privacy policy and finds each joint controller's name.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### YAML example

```yaml
- id: partner-loyalty
  name: Example Rewards AB
  role: joint_controller
  arrangement: contracts/2026-06-example-rewards-joint-control.pdf
  duties:
    data_requests: us
    privacy_notice: us
    breach_reports: partner
  contact_point: privacy@example.com
```

### JavaScript example

```js
const JOINT_DUTIES = ['data_requests', 'privacy_notice', 'breach_reports'];

export const jointControllerProblems = vendor => vendor.role !== 'joint_controller' ? [] : [
  ...(vendor.arrangement ? [] : [`${vendor.id}: no arrangement`]),
  ...JOINT_DUTIES.filter(duty => !vendor.duties?.[duty]).map(duty => `${vendor.id}: no owner for ${duty}`),
];
```

### Python example

```python
JOINT_DUTIES = ["data_requests", "privacy_notice", "breach_reports"]

def joint_controller_problems(vendor: dict) -> list[str]:
    if vendor.get("role") != "joint_controller":
        return []
    problems = [] if vendor.get("arrangement") else [f"{vendor['id']}: no arrangement"]
    duties = vendor.get("duties") or {}
    return problems + [f"{vendor['id']}: no owner for {duty}" for duty in JOINT_DUTIES if not duties.get(duty)]
```

## Sources

- [GDPR Article 26 on joint controllers](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- [EDPB Guidelines 07/2020 on controller and processor](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en)

## Related rules

- [Load embedded videos and maps only after a click](https://agentwranglers.se/playbook/website/privacy/click-to-load-embeds) in Website
- [Keep one register of vendors](https://agentwranglers.se/playbook/compliance/processors-and-transfers/vendor-register) in Compliance
- [Keep the record of processing as data](https://agentwranglers.se/playbook/compliance/records-and-data-map/records-of-processing) in Compliance
- [Check each agreement covers Article 28](https://agentwranglers.se/playbook/compliance/processors-and-transfers/dpa-article-28) in Compliance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/compliance/processors-and-transfers/joint-controllers">Agent Wranglers compliance playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Confirm deletion when a vendor leaves](https://agentwranglers.se/playbook/compliance/processors-and-transfers/vendor-exit)
- [Processors and transfers](https://agentwranglers.se/playbook/compliance/processors-and-transfers)