What it asks for. Where two or more controllers jointly determine the purposes and means of processing, they are joint controllers. They must set out their respective responsibilities for compliance, in particular for individuals' rights and the provision of information, in a transparent arrangement, unless these are determined by law. The essence of the arrangement must be made available to individuals, who may exercise their rights against each controller.
In practice. Organisations identify joint controllership in partnerships, group arrangements and some platform integrations, then document an arrangement covering who handles notices, rights requests, security and breaches. Evidence includes signed arrangements, a published summary for individuals and processes showing requests are routed correctly.
Common gaps. Joint controllership often goes unrecognised, for example with embedded social media plugins or shared marketing activities. Arrangements may exist but fail to say who does what in practice.