The Responsibility Ledger: Six Tests for Joint Controller Arrangements in UK Data Governance

Joint controllership is rarely chosen in a single meeting. It emerges from a shared HR platform, a research consortium, an integrated case management system or a local authority partnership. By the time the Article 26 arrangement is drafted, the processing is often already underway. The document may satisfy the formal requirement for a transparent allocation of responsibilities, but it frequently does little to help the organisations involved answer the questions that matter when a subject access request arrives, a personal data breach occurs or the Information Commissioner's Office asks for evidence.

The governance issue is not whether an arrangement exists. It is whether the arrangement operates as a control. A joint controller arrangement should function as a responsibility ledger: a live record of shared purposes, decision rights, evidence custody and incident roles. The six tests below are intended for UK data-governance teams that need to move beyond signatures and into operational proof.

Test one: Is the shared purpose genuinely indivisible?

Article 26 of the UK GDPR applies where two or more controllers jointly determine the purposes and means of processing. In practice, organisations often label a relationship as joint controllership without testing whether the purposes can be separated. A shared services function may be joint for one activity and separate for another. A research consortium may be joint for participant recruitment but not for onward publication. An integrated platform may involve joint determination for some data flows and processor relationships for others.

The first test is therefore a purpose map. For each processing activity, record the purpose in plain language, the data categories involved, the decisions that are genuinely shared and the boundaries of the arrangement. If the purposes can be separated cleanly, separate controllership may be the more accurate model. If they cannot, the joint purpose should be described in terms that a new member of staff could understand without reading the whole contract. The map should sit alongside the record of processing activities, not in a legal folder.

Test two: Are decision rights recorded at the point of decision?

A common weakness in joint controller arrangements is the use of cooperative language. The parties agree to consult, to cooperate and to act jointly. These phrases are rarely sufficient when a decision has to be made about a new data field, a change of supplier, a retention period or a disclosure request. The arrangement should identify who decides, who is consulted and who must be informed for each material decision.

This does not require an elaborate matrix for every minor operational choice. It does require a decision log for the issues that shape accountability: lawful basis, collection notices, new purposes, retention rules, security measures, international transfers and the appointment of processors. Each entry should record the date, the issue, the parties involved, the decision reached and where the supporting evidence is held. Over time, the decision log becomes the most useful part of the arrangement because it shows how shared responsibility was exercised in practice.

Test three: Who holds the evidence?

Joint responsibility does not mean shared filing. For each obligation, the arrangement should name an evidence custodian. Who holds the record of the lawful basis assessment? Who maintains the retention schedule? Who can retrieve the audit trail for a subject access request? Who preserves the incident log? Who holds the DPIA and the subsequent review notes?

An evidence custody schedule should record the custodian, the system or location, the retention period and the retrieval route. A shared mailbox is not a custody model. If one partner holds the record, the other should have a documented right to obtain it and a duty to preserve it. The schedule should be tested against the statutory clocks that matter most: one month for subject access requests and seventy-two hours for breach notification. If the evidence cannot be produced within those windows, the arrangement is not decision-ready.

Test four: How does an incident cross the boundary?

Incidents expose the difference between a signed arrangement and an operable one. When a personal data breach affects data processed under a joint arrangement, the parties need to know who detects, who assesses, who notifies the ICO, who communicates with affected individuals and who speaks to processors. They also need to know what happens if they disagree.

The arrangement should pre-agree an incident bridge: a single lead notifier, a common facts log, an escalation route and a no-surprise protocol for public statements. It should identify the contacts who can act outside normal office hours and the person who has authority to make a notification decision. A tabletop exercise is the simplest way to test the arrangement before an incident does it for you. The exercise should include a disagreement scenario, because consensus cannot be assumed under time pressure.

Test five: What triggers a review?

Joint controller arrangements decay quietly. Partners change, systems are replaced, purposes drift and new data categories are added. The arrangement should therefore include review triggers, not just a review date. Triggers may include a new partner, a new platform, a material change to the data set, a significant incident, an audit finding, a change in law or the implementation of new statutory provisions. In the UK context, the phased implementation of the Data (Use and Access) Act 2025 and related secondary legislation is a relevant prompt for many organisations to reconfirm their arrangements during 2026.

Each review should produce a versioned record: what changed, who approved the change, what evidence was considered and what actions were assigned. The review should be scheduled in the same governance calendar as the record of processing activities, the DPIA register and the breach playbook. An arrangement that is not reviewed is not a control; it is an archive item.

Test six: How does the arrangement end?

Exit is often omitted because the parties assume the relationship will continue. Joint controllership can end through partner withdrawal, service closure, corporate restructuring or a change in purpose. The arrangement should set out how data is returned, deleted or retained, how subject access requests will continue to be handled, how evidence will be transferred and how the regulator will be informed if required.

A wind-down plan should name the responsible owner, the evidence handover route and the retention period for the arrangement itself. Accountability does not end when the joint purpose ends. The final version of the responsibility ledger may be the most important one, because it shows that the parties planned for continuity rather than leaving an evidence gap.

Keeping the ledger live

The six tests are not a substitute for legal advice, and they are not intended to produce a perfect document. They are intended to produce operational proof. The arrangement should be owned by a named governance lead, linked to the record of processing activities, tested through incident exercises and summarised for the board in one page. The summary should answer three questions: who decided, who holds the record and who answers the regulator.

A joint controller arrangement is a living control. It should be reviewed when the partnership changes, tested when the system changes and evidenced when the regulator asks. The responsibility ledger is the difference between an arrangement that exists on paper and one that can be relied upon when responsibility is shared.