Joint Data Controllers Explained With Business Examples
Two businesses can share customer information without being joint data controllers. The distinction depends on who decides why the information is processed and how the relevant activity works, not simply who receives a spreadsheet or signs a partnership agreement.
For Jamaican organisations, getting this classification right affects privacy notices, commercial contracts, individual rights and incident handling. A co-branded campaign, shared booking service or group-wide employee programme can create overlapping responsibilities that neither partner should leave to assumption.
This guide uses illustrative business examples to explain the differences and show how to document responsibilities. The classifications depend on the actual decisions each organisation makes, not just the arrangements described on paper.
What makes organisations joint controllers?
A data controller determines the purposes and manner of processing personal data. In practical terms, this means deciding why information is needed and the significant features of how it will be used.
The controller definition in Jamaica’s Data Protection Act, 2020 covers decisions made alone, jointly or in common with others. Shared decision-making therefore matters when assessing a business partnership. Jamaica’s Office of the Information Commissioner is the relevant regulator for local guidance and compliance information.
Organisations may be joint data controllers when they together determine the purpose and significant features of a particular processing activity. For example, they might jointly decide to build a customer database, determine the information collected and agree how both businesses will use it.
Classify the processing activity, not the entire relationship. Two businesses might jointly control a campaign registration process while independently controlling their own accounting records and subsequent customer relationships.
Joint control also need not mean equal influence. Restricting one partner’s access to records does not, by itself, settle whether that partner participates in determining the processing.
Joint data controllers, independent controllers and processors
These relationships can look similar operationally but require different allocations of responsibility.
Relationship | Who makes the relevant decisions? | Illustrative situation |
Joint controllers | Organisations jointly determine the purpose and significant features of the same processing activity | Two brands jointly design a promotion and determine how participant information will be used |
Independent controllers | Each organisation determines its own purpose and processing arrangements | A retailer sends transaction information to a financial institution that processes it for its own regulatory duties |
Controller and processor | The controller determines the purpose, while a processor handles information on its behalf | A business hires a mailing provider to send an approved customer newsletter under its instructions |
A processor can exercise discretion over routine technical implementation without becoming a controller. Selecting an operational method is different from deciding to reuse customer information for a new commercial purpose.
Likewise, receiving data does not automatically make an organisation a processor. A recipient that determines its own use may be an independent controller for that activity.
PLMC’s explanation of controller and vendor responsibilities under Jamaica’s data protection framework provides further context for distinguishing outsourced services from independent decision-making.
Business examples: where shared control can arise
The following examples are hypothetical. They demonstrate how to analyse the facts rather than assign a fixed legal status to an entire industry.
A hotel and tour operator create a shared booking service
A hotel and a tour operator launch a combined accommodation-and-excursion package. Together, they decide which guest information to collect, how bookings will be coordinated and how long the shared booking records will remain available.
They may be joint data controllers for that shared booking process because both participate in determining its purpose and significant features.
Their separate activities still need separate analysis. The hotel may independently control records used for its accommodation business, while the tour operator independently controls records needed for its own operations.
The conclusion could differ if the hotel simply refers a guest to a tour operator, after which the operator independently collects information and manages its own booking. The referral alone does not establish joint control.
Two retailers run a co-branded competition
Two retailers agree to run a competition through a shared entry form. They jointly decide the eligibility rules, required personal information, winner-selection process and retention period. They also agree whether entrants will receive communications from either brand.
Shared decisions about those activities point towards joint control. Using an agency to host the form does not remove the retailers’ responsibility; the agency could be a processor if it acts only on their instructions.
Marketing requires particular care. Entering a competition should not be treated as automatic permission for every subsequent promotional use. The businesses must assess the applicable processing conditions and explain their intended uses clearly.
If one retailer later uses information for a separately determined activity, that use needs its own classification and compliance assessment.
A retailer and financial institution offer customer finance
A retailer introduces customers to a financial institution offering instalment finance. The institution decides how to assess applications, conduct required checks and retain records for its own legal obligations.
Those independent decisions generally point towards the institution acting as a separate controller for lending and anti-money laundering compliance. A commercial partnership and information exchange are not enough to establish joint control.
However, the parties might also jointly design an initial lead-generation campaign, agree what applicant information to collect and determine how leads will be routed. That shared collection stage could require a different assessment.
This illustrates why describing the entire arrangement as either joint or independent can miss important differences between processing stages.
Companies within a group share an employee programme
Several legally distinct companies establish a group-wide employee development programme. They jointly determine eligibility, assessment criteria, the information collected and which group managers can access results.
These decisions may make them joint data controllers for the programme, even though each company remains responsible for its own employment records.
By contrast, if a group service company merely administers training bookings under each employer’s instructions, it may act as a processor for that service. Shared ownership or a common brand does not settle the classification.
Employment information also needs careful access controls. Participation in a shared programme does not justify making unrelated performance, disciplinary or health records available throughout the group.
How to test a partnership before launch
Start with a specific activity, such as collecting competition entries or maintaining shared booking records. Avoid broad descriptions such as “the partnership database”, which can conceal several different uses.
Ask the operational owners these questions:
Purpose: Who decided why this information would be collected or used?
Scope: Who determined the individuals involved and the types of information required?
Use and access: Who decided what each organisation could do with the information and who could receive it?
Retention: Who determined how long records would be kept and when they would be deleted?
Change control: Who can approve a new use, additional recipient or expanded collection?
Review meeting records, campaign briefs, system requirements and actual working practices. Contract labels are useful evidence, but calling a party a “processor” cannot override its independent decisions about personal data.
Where the evidence points towards joint data controllers, record the reasoning and define the activity covered. Where roles differ by stage, document those boundaries rather than forcing one label across the whole project.
An internal department is not normally a separate controller merely because it makes operational decisions. Distinguish responsibilities within one organisation from relationships between separate organisations.
What should a shared-controller arrangement cover?
A written allocation of responsibilities helps prevent the practical failures that occur when both partners assume the other is handling compliance. It supports corporate governance, but it does not replace either organisation’s statutory duties.
The document should identify the specific processing covered, its purpose and each organisation’s role. It should also address the applicable conditions for processing, information security, permitted disclosures and retention.
For broader drafting considerations, PLMC’s guide to data protection clauses for commercial contracts explains how privacy responsibilities can be incorporated into commercial arrangements.
Allocate operational tasks clearly
Joint data controllers should establish named owners and workable procedures for the tasks they share. The following is a planning template, not a statement of mandatory contractual wording under Jamaican law.
Area | What the arrangement should resolve |
Privacy information | Who prepares the notice, who approves it and where individuals see it |
Individual rights | Who receives requests, how partners search their records and how responses are coordinated |
Security | Which safeguards each party maintains and how shared access is authorised |
Incidents | How partners alert one another, preserve evidence and assess applicable reporting obligations |
Retention | Which records are kept, for how long and how deletion or justified retention is coordinated |
Suppliers | Who appoints processors and checks the contractual and security arrangements |
Exit | What happens to records, access permissions and continuing responsibilities when the partnership ends |
A nominated contact can coordinate work without becoming solely responsible for every legal obligation. Similarly, contractual indemnities allocate commercial risk between parties; they do not determine whether statutory responsibilities exist.
Give individuals an understandable explanation
Privacy information should identify the organisations involved, explain the relevant purposes and provide a usable route for questions or rights requests. A vague reference to “selected partners” may not adequately explain a jointly operated service.
The explanation should distinguish shared processing from separate uses. For example, a booking notice can describe coordination between a hotel and tour operator without suggesting that both businesses control every record the other holds.
Rights procedures must work across organisational boundaries. If one partner receives a request concerning shared records, the arrangement should explain how it is routed and handled, rather than leaving the individual to resolve the businesses’ responsibilities.
Retention procedures also need exceptions for justified legal holds or other applicable requirements. One partner’s deletion instruction should not automatically erase records another must lawfully retain.
Jamaica’s framework and GDPR Article 26
Jamaican organisations should distinguish local legal obligations from requirements that arise under another jurisdiction’s law.
Under the EU General Data Protection Regulation, Article 26 expressly requires joint controllers to determine their respective compliance responsibilities through a transparent arrangement, subject to responsibilities already determined by applicable law. Its essence must be made available to individuals. The article also preserves an individual’s ability to exercise rights against each controller.
Do not assume Article 26 applies to every Jamaican partnership. Assess GDPR territorial scope separately. It may apply through an EU establishment or qualifying activities involving offers to individuals in the EU or monitoring their behaviour there. A customer’s EU nationality alone does not establish applicability.
For joint data controllers operating under Jamaica’s framework, clear written responsibilities remain a practical governance measure. The precise legal requirements should be assessed under the Jamaican Act and any other law that actually applies, rather than importing an overseas template unchanged.
Frequently asked questions
Does sharing personal data automatically create joint control? No. Sharing can occur between independent controllers or between a controller and processor. The central question is who determines the purpose and significant features of the relevant processing.
Can one company be a joint controller for one activity and a processor for another? Yes. Roles are assessed by activity. A company could participate in determining a shared campaign while separately providing an administrative service under another organisation’s instructions.
Must both organisations have access to every record? Not necessarily. Access is relevant evidence, but it is not the only consideration. Examine each organisation’s influence over the purpose and significant features of processing rather than relying solely on system permissions.
Can an agreement make one partner responsible for everything? It can assign operational tasks and commercial risk, but it cannot override statutory obligations. Each organisation needs to understand the duties arising from its actual role.
Clarify responsibilities before collecting information
Before launching a shared service, document the processing stages, identify who makes the relevant decisions and agree how privacy responsibilities will work in practice.
Privacy & Legal Management Consultants Ltd. offers data protection implementation, corporate governance services and training for Jamaican organisations. Request a free consultation to discuss your partnership’s data flows, role classification and compliance needs.