Cyprus GDPR joint-controller arrangements: Article 26

Apply the factual joint-controller test before drafting

Begin with the processing operation, not the job title on the contract. A controller decides why and how personal data is processed; joint controllers participate together in determining the purposes and essential means of an operation. The European Data Protection Board explains that participation can be a common decision or converging decisions that complement each other and are necessary for the operation in its actual form. A Cyprus business and a partner may therefore share control over a co-branded event registration while each remains a separate controller for its own existing customer database.

Ask who chose the purpose, whose interests the operation serves, who selected the categories of people and data, and who decides recipients, retention and essential technical route. Unequal influence does not automatically prevent joint control. Equally, two independent businesses can exchange information for distinct purposes without jointly determining a shared operation. A processor instead acts on behalf of a controller and processes under its instructions. Document the factual answers before deciding whether the document should be an Article 26 arrangement, an Article 28 processing agreement or another data-sharing instrument.

Do not assume that the absence of a signed agreement removes joint-controller status. The Court of Justice held in Case C-683/21 that the classification follows the parties' participation in determining purposes and means; the Article 26 arrangement is a duty arising after that classification, not a prerequisite for it. A contract saying 'independent controllers' does not settle the question if the actual project is jointly designed. Conversely, signing a broad joint-controller template should not relabel every later, unrelated use of the same data as joint processing.

A vendor that only follows the controller's instructions needs a different instrument; see the Article 28 processor-agreement guide.

Basis and guidance: Regulation (EU) 2016/679, GDPR, Articles 4, 12, 13, 14, 26, 28, 33 and 34; EDPB Guidelines 07/2020 on the concepts of controller and processor, final version 2.1; Court of Justice of the EU, Case C-683/21, Article 26 joint-control classification; European Commission: Application of the GDPR and roles of controllers and processors

Map joint and separate phases of the same project

Draw a short data-flow map before allocating duties. For an event, this might show each company's original customer list, the decision to combine invitations, a shared registration form, attendance records and later independent sales follow-up. The invitation design and registration may be joint if both parties determine the shared purpose and essential means. The later use of each company's pre-existing records may be independent. Classifying the whole commercial relationship with one label can hide these boundaries and produce a privacy notice that misstates who controls each step.

For each phase, list the personal-data categories, collection source, access, recipients, intended use, retention trigger and system owner. Identify any vendor that processes the data for the project and which controller contracts with it. If the platform provider determines a separate purpose for its own data use, that activity may need a distinct role assessment. A diagram should show how a correction or deletion in one system reaches the other party when the request concerns the joint phase. This is more useful than a clause saying only that both sides will 'comply with GDPR'.

Keep evidence of the decisions the parties actually made: workshop notes, product requirements, form fields, target-audience selection and agreement on sharing. These facts matter more than which logo appears first on the page. Revisit the map when a new partner joins, a campaign adds profiling or data begins moving to a new platform. Joint control can attach to one operation without making the parties jointly responsible for all processing they perform. Make that scope visible in the arrangement's opening schedule and in the information provided to individuals.

Basis and guidance: Regulation (EU) 2016/679, GDPR, Articles 4, 12, 13, 14, 26, 28, 33 and 34; EDPB Guidelines 07/2020 on the concepts of controller and processor, final version 2.1; European Commission: Application of the GDPR and roles of controllers and processors

Check a lawful basis and purpose for each controller

An Article 26 arrangement does not create a lawful basis for processing. Each joint controller must assess its own Article 6 basis for the relevant operation and explain the purpose to the affected person. The EDPB specifically states that each joint controller has a duty to ensure it has a legal basis and that data are not further used incompatibly with the original collection purpose. Where special-category data are involved, an Article 9 condition may also be needed. Do not solve an uncertain basis by assigning the entire issue to the partner in a contractual schedule.

Examine the origin of each dataset. If one partner supplies customer details for a joint campaign, ask what people were told at collection, whether that transfer and new use are compatible with the original purpose, and whether electronic-marketing rules impose separate requirements. A partner's warranty that its list is 'compliant' is useful evidence to request, but it does not replace a concrete analysis of the new processing. Include a data-minimisation rule: an event check-in needs a smaller set of data than a full customer export, and the shared system should reflect that distinction.

Document any change in purpose as a change-control event. A jointly run educational webinar may later become a lead-scoring programme; the later activity should not be quietly added to the original registration data. Reassess the role, lawful basis, transparency and possible impact assessment before the change. If one controller wants to use joint records for its own follow-up, identify where the joint operation ends and its separate purpose begins. A clear boundary makes it possible to answer a participant accurately about which organisation is responsible for a particular message.

When the shared project involves systematic high-risk processing, use the DPIA screening workflow before launch.

Basis and guidance: Regulation (EU) 2016/679, GDPR, Articles 4, 12, 13, 14, 26, 28, 33 and 34; EDPB Guidelines 07/2020 on the concepts of controller and processor, final version 2.1; European Commission: Application of the GDPR and roles of controllers and processors

Allocate responsibilities in a usable Article 26 arrangement

Article 26 calls for a transparent determination of the parties' respective responsibilities, particularly for providing information under Articles 13 and 14 and enabling data-subject rights, unless and to the extent Union or Member State law already determines those responsibilities. Assign a named owner and backup for the initial notice, request intake, identity checks, data searches, decision, response and recordkeeping. Say what happens if the person contacts the other party. The arrangement should reflect the real roles and relationships with the people concerned rather than presenting an equal split for every task merely because there are two signatures.

The EDPB recommends covering other controller obligations too: the data-protection principles, legal basis, security, breach notifications, impact assessments, processor use, international transfers and dealings with individuals and authorities. Translate that into measurable hand-offs. For example, set an internal deadline for Party A to notify Party B of a request and specify which system export Party B must provide. Keep enough time for the externally applicable GDPR deadlines. A clause that says 'each party handles requests relating to its systems' is inadequate when the joint activity spans both systems.

Article 26 does not prescribe a single legal form. The EDPB recommends a binding document for legal certainty and accountability. Include a defined processing schedule, responsibility matrix, escalation contacts, evidence-exchange rules, security minimums, change control and exit steps. Avoid copying an Article 28 processor template: neither joint controller is necessarily acting only on the other's documented instructions. If a partner also provides a separate processing service, document that distinct Article 28 relationship for that activity rather than trying to stretch one role label across both.

For the different terms required when a supplier acts on instructions, compare the processor-contract checklist.

Basis and guidance: Regulation (EU) 2016/679, GDPR, Articles 4, 12, 13, 14, 26, 28, 33 and 34; EDPB Guidelines 07/2020 on the concepts of controller and processor, final version 2.1; European Commission: Application of the GDPR and roles of controllers and processors

Design the rights path around the individual, not the contract

The arrangement may designate a contact point, but Article 26(3) allows the individual to exercise GDPR rights in respect of and against each joint controller regardless of the internal allocation. A privacy page that says requests are valid only if sent to one partner misstates that position. Both help desks should recognise a request, record its receipt and route it promptly. The lead contact can coordinate, but the data search and response must cover the relevant operation across both parties where necessary.

Test access, correction, objection and deletion with a realistic record. If a participant changes an email address, who updates the shared event platform and who tells the partner? If the person objects to direct marketing, which party stops the jointly controlled campaign and which separate follow-up lists also need their own assessment? Record how conflicting instructions or uncertain identity are resolved. A rights response should describe the actual data and purpose, not simply attach the Article 26 agreement. Preserve an audit trail of each hand-off and the final communication.

Set an escalation path for a request received just before a reporting deadline. Article 12's normal one-month response period applies to rights requests, subject to its conditions for extension; a slow internal approval loop is not by itself a reason to miss it. If one partner refuses a proposed decision, the arrangement should identify who reviews the disagreement and how the person receives a timely, accurate response. The contract's allocation cannot remove a right the GDPR gives the individual, so design the workflow to succeed even when the person contacts the 'wrong' party first.

The operational detail for producing a person's data is covered in the GDPR access-request guide.

Basis and guidance: Regulation (EU) 2016/679, GDPR, Articles 4, 12, 13, 14, 26, 28, 33 and 34; EDPB Guidelines 07/2020 on the concepts of controller and processor, final version 2.1; European Commission: Application of the GDPR and roles of controllers and processors

Make security and incident duties work across the boundary

A shared purpose often relies on different infrastructure: one partner runs the registration form, another stores attendee exports, and an agency sends messages. Agree who grants access, reviews permissions, secures transfer, logs exports and removes access at the end. Specify security evidence each party can request without exposing unrelated systems. Joint control does not automatically mean each partner can inspect every database the other owns. Limit access to the joint operation and set retention and deletion steps for its copies.

For a breach, create a fast internal alert rather than copying the GDPR's external timetable into an internal notification clause. Identify the incident contact, evidence to preserve, who assesses risk to individuals, who communicates with the Cyprus Commissioner when required, and who informs individuals when Article 34 applies. Article 33's 72-hour authority-notification benchmark runs from awareness under its conditions, so a partnership cannot spend most of that period deciding which side owns the incident. Rehearse a lost export and an exposed registration form before launch.

Where a vendor or cloud service is used, map the relevant processor contract and any transfer outside the EEA. An Article 26 arrangement between the two controllers does not substitute for Article 28 terms with a processor or Chapter V transfer safeguards. Assign who approves a new subprocessor, who verifies a transfer mechanism and how the other party receives evidence before data flows. If the system changes, update both the responsibility matrix and the privacy information. A clear allocation helps coordinate action; it does not make either controller invisible to the data subject or the authority.

For an incident playbook, consult the Cyprus GDPR breach-response guide.

Basis and guidance: Regulation (EU) 2016/679, GDPR, Articles 4, 12, 13, 14, 26, 28, 33 and 34; EDPB Guidelines 07/2020 on the concepts of controller and processor, final version 2.1

Publish the essence of the arrangement in clear language

Article 26(2) requires the essence of the joint-controller arrangement to be made available to data subjects. The EDPB explains that this should reflect the parties' actual roles and relationships. A useful notice names the controllers, describes the shared operation, explains which party supplies the information and coordinates rights, and gives a working route to contact each party. It should also clarify any separate purposes after the shared phase. A bare sentence saying 'we are joint controllers' gives too little information for a person to understand who is using their data and why.

Do not publish the full confidential contract as the only explanation. The essence can be a concise, readable summary linked from the registration form and each partner's relevant privacy page. Align it with the full Articles 13 and 14 information, including purposes, lawful bases, recipients, retention and rights. If one partner collects data directly while the other receives it later, decide how the information duties are actually satisfied. Check the notice on mobile and in the languages used by the joint project; the wording should match the real interface and the current contact addresses.

The public summary and internal arrangement must remain consistent after changes. When a partner leaves, a third party joins or a new use is added, update the role map, responsibility matrix and notice together. Preserve a dated version so the team can explain what a person was told when their data entered the project. The chosen contact point is an operational convenience, not a restriction on Article 26(3) rights. If a person contacts either controller, their request still has to be handled under the GDPR.

Basis and guidance: Regulation (EU) 2016/679, GDPR, Articles 4, 12, 13, 14, 26, 28, 33 and 34; EDPB Guidelines 07/2020 on the concepts of controller and processor, final version 2.1; European Commission: Application of the GDPR and roles of controllers and processors

Review the arrangement against four concrete scenarios

Before signing, run a classification scenario. Both parties should describe the same operation and independently explain who decides its purpose and essential means. Compare the answers with the service design and the contract. If they disagree on whether a vendor is a processor or a joint controller, resolve the factual question rather than inserting more labels. Then run an intake scenario: a person asks either party for their shared event data. Verify that the request is logged, searched across relevant systems and answered within the applicable period.

Run an incident scenario in which one party's export is exposed on a Friday evening. Confirm who receives the alert, which evidence is preserved, how risks and notification duties are assessed, and how the other party can act without waiting for commercial approval. Then run an exit scenario: the collaboration ends but one party wants to keep the shared records for its own sales. Identify what the arrangement allows, what separate lawful basis and notice would be needed, and what must be returned, deleted or retained for a distinct legal reason.

Sign only when the documented roles match those tests. Keep the processing schedule, contact details, privacy text, processor contracts and transfer records in one controlled file. Assign a review date and triggers for changes in systems, partners or purposes. The purpose of an Article 26 arrangement is not to shift every risk to one party; it is to make the actual allocation intelligible to the people affected and executable by both organisations. A short agreement that passes these scenarios is more valuable than a long template no team can operate.

Basis and guidance: Regulation (EU) 2016/679, GDPR, Articles 4, 12, 13, 14, 26, 28, 33 and 34; EDPB Guidelines 07/2020 on the concepts of controller and processor, final version 2.1; Court of Justice of the EU, Case C-683/21, Article 26 joint-control classification; European Commission: Application of the GDPR and roles of controllers and processors

Primary sources and scope

Sources checked: October 7, 2026. This guide concerns the Republic of Cyprus. Examples are hypothetical, not client case studies. Check current official requirements before making a filing.

• Regulation (EU) 2016/679, GDPR, Articles 4, 12, 13, 14, 26, 28, 33 and 34
• EDPB Guidelines 07/2020 on the concepts of controller and processor, final version 2.1
• Court of Justice of the EU, Case C-683/21, Article 26 joint-control classification
• European Commission: Application of the GDPR and roles of controllers and processors