Key takeaway
Allocate who performs each task, while preserving the person’s ability to exercise rights against each joint controller. A designated contact point coordinates the work.
Take the established processing role into the operating plan
Two organizations have completed a role review for a defined shared study and concluded that they jointly determine its purposes and means. The proposed arrangement names one privacy contact. A request then reaches the other organization. The next question is operational: who receives, routes, answers and records it?
EU GDPR Article 26 requires a transparent allocation of respective responsibilities through an arrangement, unless and insofar as relevant Union or Member State law determines them. It highlights rights and Article 13/14 information, requires the essence of the arrangement to be available and preserves rights against each controller. This guide starts after the scoped role conclusion; it does not infer joint control from a shared file.
Complete the handoff before the study starts
Hypothetical example: fictional companies Alder and Birch are assumed to be joint controllers only for study S4. Alder maintains participant-facing notices and Birch operates the study records. Their legal teams still need to review the actual arrangement, lawful basis and other applicable duties. No real personal data or request appears in this example.
The initial draft tells Birch to reject requests and send people to Alder. The repaired operating record instead gives Birch an intake and coordination step. It assigns practical work while avoiding a claim that the contractual allocation binds the person.
| Illustrative event | Allocated operating action | Boundary to retain |
|---|---|---|
| A request reaches Birch | Record receipt and coordinate with Alder through the agreed controlled process | Do not reject solely because Alder is the designated contact |
| Alder prepares an answer | Obtain the relevant S4 facts from Birch and review the response | Each controller retains its applicable obligations |
| Notice information changes | Named owners reconcile the shared processing description | Keep the available essence and notices consistent |
| A new independent use is proposed | Open a separate purpose/role review | S4 joint-control allocation does not cover every later operation |
Make the available explanation match the actual arrangement
The EDPB’s Guidelines 07/2020 explain that the arrangement should reflect the real roles and that people need to understand which controller is responsible for what. The guidance recommends how to present the essence, including relevant notice information and a contact point if one is designated. That is different from assuming the full confidential commercial agreement must always be published verbatim.
For S4, the available explanation identifies the two entities, the scoped study and how to reach the coordinating contact. The internal arrangement identifies the people and systems needed to retrieve facts and resolve a request. A privacy notice that promises one route while the second company’s help desk rejects it creates an avoidable operational gap.
Article 26 permits a contact point; it does not make that designation mandatory. The EDPB recommends one to facilitate coordination. Preserve the distinction between a statutory requirement and guidance when the legal team selects its approach.
Test the inconvenient route as well as the intended one
Use invented messages in an authorized internal exercise: a request to the designated contact, one to the other controller and one that concerns processing outside S4. Record whether the team identifies the scope, routes it appropriately and retains the receipt and response trail. No live submission or actual personal record is needed to test the handoff design.
The EDPB explains that people can choose either controller despite the allocated contact point and recommends advance coordination for such requests. Do not turn an internal assignment into a rule requiring the person to start again elsewhere. Identity, deadline, exemptions and the substantive response still require their own applicable review.
A one-sided change to retention, recipients or study purpose can also change dependent reviews. Preserve who can approve the changed operation and how the arrangement and available information will be reconsidered. The original S4 document should remain traceable to the scope it actually examined.
Keep a role arrangement from becoming processing permission
The fictional repair produces a usable request route and a specific drafting agenda. It does not establish a lawful basis, approve a transfer, resolve sensitive-data conditions or clear the study. The role record and the processing-permission record are separate dependencies.
Use rights review for the outstanding issues and due diligence to understand the recipient’s actual operating responsibilities. A VOID introduction authorizes only the approved named conversation and metadata. It does not make VOID a party to the shared study or supply the later permissions.
Use this review agenda with your legal and privacy advisers. Requirements depend on the records, jurisdictions and intended use.