What does joint controllership under Art. 26 GDPR mean for a group-wide IAM, and what does it require?
The companies involved jointly determine the purposes and means of the IAM processing and must set out in a transparent arrangement who fulfils which data-protection obligation; it suits large groups, but for IAM it is relatively new with little practical experience.
Article 26 GDPR covers the case where two or more controllers jointly determine why and how personal data is processed. For a group IAM that maps naturally: the subsidiaries contribute their data, a central entity runs the system, and they decide together what the IAM is for.
What the law requires:
- An arrangement between the joint controllers that sets out, transparently, their respective responsibilities, especially for informing data subjects and handling their requests (access, correction, deletion).
- The essence of the arrangement must be made available to the data subjects.
- Regardless of the internal split, a data subject may exercise their rights against each of the controllers.
Why it fits: it gives the central IAM a legitimate role as a co-decider instead of a mere instruction-taker, which a processor set-up cannot. Why caution: applying joint controllership to IAM is still relatively new, so there is little established practice. (Swiss law knows the same idea: under the revised FADP a controller is whoever determines purpose and means "alone or jointly with others".)
Go deeper:
Art. 26 GDPR: Joint controllers — the full text: the arrangement, its essence for data subjects, and rights against each controller.- EDPB Guidelines 07/2020 on controller and processor — how regulators assess joint decisions on purpose and means.