Joint Controller Agreement Spain (Acuerdo de Corresponsables del Tratamiento)

A Joint Controller Agreement Spain (Acuerdo de Corresponsables del Tratamiento) is a formal written arrangement between two or more organisations that jointly determine the purposes and means of processing personal data, establishing the respective responsibilities of each organisation for compliance with data protection obligations, governed principally by Article 26 of the Reglamento General de Protección de Datos (Reglamento (UE) 2016/679 — RGPD), directly applicable in Spain since 25 May 2018, and supplemented by the Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD) and the oversight of the Agencia Española de Protección de Datos (AEPD).

Article 26.1 RGPD establishes that where two or more controllers jointly determine the purposes and means of processing — corresponsables del tratamiento in Spanish — they must determine their respective responsibilities for compliance with RGPD obligations in a transparent manner through an arrangement (acuerdo or arreglo) between them. The essence of joint controllership is the joint determination of both the why (purposes) and the how (means) of processing — where one party merely provides a service following the other's instructions, the relationship is one of controller-processor (responsable-encargado) under Article 28 RGPD, not joint controllers.

The distinction between joint controllership and the controller-processor relationship was clarified by the Court of Justice of the European Union (CJEU) in key rulings: Case C-25/17 (Jehovah's Witnesses, 2018) — religious communities and door-to-door evangelists are joint controllers; Case C-210/16 (Wirtschaftsakademie, 2018) — Facebook fan page administrators and Facebook are joint controllers for visitor data analytics; and Case C-40/17 (Fashion ID, 2019) — website operators embedding Facebook Like buttons are joint controllers with Facebook for the initial data collection. These CJEU rulings significantly broadened the joint controller concept and the AEPD has applied this jurisprudence in Spanish enforcement decisions.

The AEPD — Spain's independent supervisory authority established under Article 36 LOPDGDD, operating from its headquarters in Calle Jorge Juan 6, 28001 Madrid — exercises investigative and corrective powers over data controllers in Spain under Articles 57 and 58 RGPD. The AEPD publishes practical guides (guías prácticas) on joint controllership, including the Guía sobre las relaciones entre responsable y encargado del tratamiento (2021), which provides detailed analysis of when organisations are joint controllers versus controller-processor.

Spanish organisations acting as joint controllers must confirm their arrangement covers the allocation of data subject rights (derechos de los interesados) responses — access (acceso), rectification (rectificación), erasure (supresión — derecho al olvido), restriction (limitación), portability (portabilidad), and objection (oposición) under Articles 15 through 21 RGPD. Under Article 26.3 RGPD, data subjects may exercise their rights against each joint controller irrespective of the internal allocation — making the arrangement's practical mechanics critical to avoid double-handling or gaps.

The LOPDGDD Articles 37 through 42 provide the Spanish national framework supplementing RGPD joint controller provisions, including specific rules on data protection officers (delegados de protección de datos — DPD), mandatory DPD appointment requirements for public authorities, organisations processing special categories of data at scale, and criminal record data processors under Article 34 LOPDGDD.

A Joint Controller Agreement Spain is required whenever two or more organisations independently determine the purposes and means of a shared personal data processing activity — the RGPD Article 26 obligation to document the arrangement in writing applies whenever joint controllership exists in fact, regardless of whether the organisations formally recognise it.

The agreement is needed when two companies within the same corporate group (grupo empresarial) share employee HR data, customer databases, or CRM systems for jointly determined marketing, analytics, or operational purposes — Spanish corporate groups where parent and subsidiary companies share data infrastructure are joint controllers for the shared processing activities, even if the parent dominates decision-making, as confirmed by AEPD enforcement decisions.

A Joint Controller Agreement is required when a Spanish business and a technology platform partner — such as a social media platform, analytics provider, or advertising network — together determine the purposes of processing visitor or user data. Following the CJEU Fashion ID judgment (C-40/17, 2019), Spanish companies embedding third-party tracking technologies (pixels, cookies, SDKs) on their websites are joint controllers with the technology provider for the initial data collection phase.

The agreement is needed when Spanish healthcare providers (centros de salud, hospitales) participate in shared electronic health record (historia clínica electrónica) systems operated by Autonomous Community health authorities (Consejerías de Sanidad) — both the healthcare provider and the regional health authority jointly determine the purposes of health data processing and must document their respective responsibilities.

A Joint Controller Agreement is required when Spanish public administrations — Ayuntamientos, Diputaciones, Ministerios — share citizen data with other public bodies through interoperability platforms regulated by the Ley 40/2015 de Régimen Jurídico del Sector Público and the Esquema Nacional de Interoperabilidad (ENI — Real Decreto 4/2010). The AEPD has specifically addressed joint controller arrangements between public administrations in its Informe 0042/2020.

The document is also needed when Spanish research institutions (universidades, centros de investigación) share personal data across consortium research projects, clinical trials, or epidemiological studies — consortium members that collectively design the research protocol and data collection methodology are joint controllers, requiring a data sharing agreement that meets Article 26 RGPD requirements alongside any applicable clinical trial regulations under Ley 14/2007 de Investigación Biomédica.

A valid Joint Controller Agreement Spain under RGPD Article 26 and LOPDGDD must contain the following provisions to satisfy regulatory requirements and withstand AEPD scrutiny in an investigation or complaint procedure.

Identification of Joint Controllers: Full legal name, NIF/CIF, registered address, and data protection contact details of each joint controller. Identification of the Data Protection Officer (Delegado de Protección de Datos — DPD) of each party, where appointed under Article 37 RGPD or mandated under Article 34 LOPDGDD. The DPD contact point must be published on the organisation's website under Article 37.7 RGPD.

Description of Joint Processing Activities: Precise description of the processing activity (actividad de tratamiento) subject to joint control — the personal data categories processed (datos personales ordinarios or datos especialmente protegidos under Article 9 RGPD), the data subjects (interesados) affected, the processing purposes (finalidades), the legal basis for processing (base jurídica) under Article 6 RGPD, and the processing operations performed by each party.

Allocation of RGPD Obligations: The specific allocation between the joint controllers of responsibilities for: (a) confirming a valid legal basis exists for the processing; (b) providing the privacy notice (información de privacidad) to data subjects under Articles 13 and 14 RGPD — including who provides the notice and in what form; (c) implementing appropriate technical and organisational security measures under Article 32 RGPD; (d) maintaining records of processing activities (registro de actividades de tratamiento) under Article 30 RGPD; (e) conducting Data Protection Impact Assessments (DPIA — Evaluación de Impacto en la Protección de Datos) under Article 35 RGPD where required; and (f) reporting personal data breaches (violaciones de seguridad) to the AEPD within 72 hours under Article 33 RGPD.

Data Subject Rights Handling: The agreed procedure for receiving, processing, and responding to data subject rights requests (derechos de los interesados) — access, rectification, erasure, restriction, portability, and objection — within the one-month deadline of Article 12.3 RGPD. The single contact point (punto de contacto único) for data subjects must be identified, though under Article 26.3 RGPD each controller remains individually liable regardless of the internal allocation.

Data Retention and Deletion: The agreed data retention periods (plazos de conservación) for each data category, aligned with the processing purpose and applicable legal obligations. The procedure for deletion or anonymisation upon expiry of the retention period, and allocation of responsibility for secure deletion.

International Data Transfers: Where personal data is transferred outside the European Economic Area (EEA) — including to processors or sub-processors using cloud infrastructure — the applicable transfer mechanism under Chapter V RGPD (Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914; adequacy decisions; binding corporate rules) must be identified and responsibility for implementing transfer safeguards allocated between the joint controllers.

Liability and Indemnification: The internal allocation of liability between the joint controllers for RGPD fines and compensation claims — AEPD administrative fines for serious violations (Article 83.5 RGPD) reach up to €20 million or 4% of global annual turnover. The LOPDGDD Article 77 establishes specific sanction procedures for public administrations. The indemnification mechanism between joint controllers for compensation paid to data subjects under Article 82 RGPD must be specified.

Forms-legal.com provides this Joint Controller Agreement Spain template as a practical starting point. Every joint controller arrangement should be reviewed by a qualified abogado especialista en protección de datos or DPD with knowledge of AEPD enforcement practice and the specific processing context — mischaracterisation of joint controller relationships is a recurring finding in AEPD investigations and can result in administrative sanctions.