If your organisation processes personal information about individuals, it must comply with data protection laws. In the United Kingdom, the UK General Data Protection Regulation (UK GDPR) is the main law governing the use of personal data. Most of the UK GDPR rules apply to \u2018data controllers\u2019. Data controllers are organisations that decide how to process personal data. If two or more data controllers jointly agree on how personal data is processed, they will be deemed \u2018joint data controllers\u2019. This article will explore what a joint controller is under the UK GDPR. <\/p>\n\n\n\n
A data controller<\/a> is a person or organisation that (alone or jointly with others) determines the purposes and means of processing personal data.<\/p>\n\n\n\n In a commercial context, a data controller is a business that chooses how to use personal information. <\/p>\n\n\n\n For example, a business may:<\/p>\n\n\n\n A data controller will generally:<\/p>\n\n\n\n This significantly contrasts with the role of a \u2018data processor\u2019 who does not control personal data but acts on a controller’s instructions. Service providers often act as data processors by following the instructions of their customers regarding how to use personal data. <\/p>\n\n\n\n Often, commercial organisations will share personal data with other organisations. For example, this may occur for joint collaboration projects or research purposes. <\/p>\n\n\n\n Two scenarios could arise if your organisation shares personal data with another data controller.<\/p>\n\n\n\n Firstly, you can share personal data with another data controller, and both parties jointly determine the purposes and means of processing. In this case, you will be joint controllers. Accordingly, both parties will process the same personal data<\/a> for a joint purpose. This could be for a collaboration project between two commercial entities.<\/p>\n\n\n\n Alternatively, you can also share personal data with another controller to use for its own individual purpose. For example, where a university shares staff data with potential sponsors to assess for their own purposes. In this case, the two organisations sharing personal data have entirely different objectives for using the data. <\/p>\n\n\n\n In a joint controller scenario, additional rules and considerations apply under the UK GDPR. If you act as a joint data controller, you must carefully consider and comply with the relevant rules. You should seek legal advice if you need clarification on the applicable rules. <\/p>\n\n\n\n\n\n Continue reading this article below the form\n <\/i>\n<\/a>\n\n
\n
What is a Joint Controller?<\/h2>\n\n\n\n