All Countries
Joint Controller Agreement

Joint Controller Agreement Template for Australia

Create a bespoke document in minutes,  or upload and review your own.

4.6 / 5
4.8 / 5

Let's create your Joint Controller Agreement

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Get your first 2 documents free

Your data doesn't train Genie's AI

You keep IP ownership of your information

Key Requirements PROMPT example:

Joint Controller Agreement

"I need a Joint Controller Agreement for a partnership between our fintech company and a major bank, where we'll jointly process customer payment data starting March 2025, with specific focus on APP compliance and cross-border transfers to New Zealand."

Celebrated by
Collaborations with
Investors
Document background
This Joint Controller Agreement is essential when two or more organizations jointly determine how personal data will be processed in Australia. It is required for compliance with the Privacy Act 1988 and Australian Privacy Principles (APPs), particularly when organizations share decision-making authority over data processing activities. The agreement should be used when parties collaborate on projects involving shared data processing, joint ventures, or integrated services where both parties influence how personal data is handled. It establishes clear lines of responsibility, ensures transparent communication to data subjects, and sets out procedures for managing data protection obligations, including breach notification and subject access requests. The document is crucial for demonstrating compliance with Australian privacy laws and establishing clear accountability between joint controllers.
Suggested Sections

1. Parties: Identification of the joint controllers entering into the agreement

2. Background: Context of the agreement, nature of joint processing activities, and general purpose

3. Definitions: Key terms used in the agreement, including privacy law-specific terminology

4. Scope and Purpose: Detailed description of the joint processing activities and purposes covered

5. Roles and Responsibilities: Specific duties of each controller and allocation of responsibilities

6. Data Protection Obligations: Compliance requirements under Privacy Act and APPs, including security measures

7. Data Subject Rights: Procedures for handling data subject requests and determining responsibility

8. Data Breach Notification: Processes for identifying, reporting, and managing data breaches

9. Liability and Indemnification: Allocation of liability between controllers and indemnification provisions

10. Term and Termination: Duration of agreement and circumstances for termination

11. General Provisions: Standard contractual clauses including governing law, notices, and amendments

Optional Sections

1. Cross-border Data Transfers: Required if personal data will be transferred outside Australia

2. Industry-Specific Compliance: Include if controllers operate in regulated industries (e.g., healthcare, financial services)

3. Joint Marketing Activities: Required if controllers will conduct joint marketing using personal data

4. Data Protection Impact Assessment: Include if processing activities are likely to result in high risk to individuals

5. Dispute Resolution: Optional detailed procedures for resolving disputes between controllers

6. Insurance Requirements: Include if specific insurance coverage is required for data protection

7. Audit Rights: Optional provisions for mutual audit rights between controllers

Suggested Schedules

1. Schedule 1 - Categories of Personal Data: Detailed list of personal data types being processed

2. Schedule 2 - Processing Activities: Detailed description of all joint processing activities

3. Schedule 3 - Technical and Organizational Measures: Security and organizational measures implemented by both parties

4. Schedule 4 - Data Subject Request Procedure: Detailed procedures for handling data subject requests

5. Schedule 5 - Data Breach Response Plan: Detailed procedures for responding to data breaches

6. Schedule 6 - Contact Points: Key contacts for each controller for various purposes

7. Appendix A - Information Notice Template: Template for providing privacy notices to data subjects

8. Appendix B - Data Processing Register: Template for maintaining records of processing activities

Authors

Alex Denne

Head of Growth (Open Source Law) @ Genie AI | 3 x UCL-Certified in Contract Law & Drafting | 4+ Years Managing 1M+ Legal Documents | Serial Founder & Legal AI Author

Linkedin in social icon imageX social icon image
alex.den.21@genieai.co
Relevant legal definitions
Agreement
APP Guidelines
Australian Privacy Principles
Business Day
Commencement Date
Confidential Information
Consent
Controller
Data Breach
Data Protection Laws
Data Subject
Effective Date
Government Agency
Joint Processing Activities
Joint Processing Purposes
Law
Notifiable Data Breach
OAIC
Personal Information
Privacy Act
Privacy Policy
Processing
Processor
Representatives
Security Measures
Sensitive Information
Services
Technical and Organizational Measures
Term
Third Party
Relevant Industries

Financial Services

Healthcare

Technology

Retail

Education

Professional Services

Insurance

Telecommunications

Real Estate

Marketing and Advertising

E-commerce

Government and Public Sector

Relevant Teams

Legal

Compliance

Information Security

Risk Management

IT

Data Protection

Operations

Privacy

Information Management

Corporate Governance

Relevant Roles

Chief Privacy Officer

Data Protection Officer

Chief Legal Officer

Privacy Manager

Compliance Manager

Information Security Manager

Risk Manager

Legal Counsel

Chief Information Security Officer

Chief Technology Officer

Project Manager

Operations Director

Chief Executive Officer

Commercial Director

Industries
Privacy Act 1988 (Cth): The primary federal legislation governing privacy and data protection in Australia, including the Australian Privacy Principles (APPs) which set out obligations for collecting, using, storing and disclosing personal information
Privacy Amendment (Notifiable Data Breaches) Act 2017: Establishes the Notifiable Data Breaches scheme, requiring organizations to notify affected individuals and the OAIC when a data breach is likely to result in serious harm
Australian Consumer Law (Schedule 2 of the Competition and Consumer Act 2010): Contains provisions relating to misleading and deceptive conduct which may apply to privacy policies and data handling practices
State Privacy Laws (e.g., Privacy and Personal Information Protection Act 1998 NSW): State-specific privacy legislation that may apply depending on the jurisdiction and whether dealing with state government agencies or private organizations
Security of Critical Infrastructure Act 2018: May be relevant if the joint controllers are handling data related to critical infrastructure sectors, imposing additional security obligations
Spam Act 2003: Relevant if the joint controllers will be engaging in electronic marketing or communications, setting out requirements for consent and opt-out mechanisms
Privacy Amendment (Privacy Enhancement) Act 2022: Recent amendments introducing increased penalties for privacy breaches and enhanced enforcement powers for the Privacy Commissioner
Teams

Employer, Employee, Start Date, Job Title, Department, Location, Probationary Period, Notice Period, Salary, Overtime, Vacation Pay, Statutory Holidays, Benefits, Bonus, Expenses, Working Hours, Rest Breaks,  Leaves of Absence, Confidentiality, Intellectual Property, Non-Solicitation, Non-Competition, Code of Conduct, Termination,  Severance Pay, Governing Law, Entire Agreemen

Find the exact document you need

Personal Information Processing Agreement

An Australian law-governed agreement establishing terms for personal information processing between controllers and processors, ensuring compliance with the Privacy Act 1988 and APPs.

find out more

DPA Data Processing Addendum

An Australian-law compliant agreement that establishes terms for processing personal information under the Privacy Act 1988 and APPs, defining data handling obligations between controllers and processors.

find out more

Data Processing Agreement Addendum

An Australian-compliant addendum governing data processing responsibilities between controllers and processors under the Privacy Act 1988.

find out more

Joint Controller Agreement

An Australian law-governed agreement establishing rights and obligations between joint controllers of personal data under the Privacy Act 1988.

find out more

Intra Group Data Sharing Agreement

An Australian law-governed agreement regulating data sharing between entities within the same corporate group, ensuring compliance with privacy laws and data protection requirements.

find out more

Dpia Agreement

An Australian agreement governing the conduct of Data Protection Impact Assessments under the Privacy Act 1988 and related privacy laws.

find out more

Subprocessor Agreement

An Australian legal agreement governing data processing arrangements between a processor and subprocessor, ensuring compliance with Australian privacy laws and data protection requirements.

find out more

Master Data Protection Agreement

An Australian law-governed agreement establishing data protection obligations between parties, ensuring compliance with the Privacy Act 1988 and related privacy legislation.

find out more

Controller To Controller Data Processing Agreement

An Australian law-compliant agreement governing personal data sharing between two independent data controllers, ensuring Privacy Act 1988 and APP compliance.

find out more

Intra Group Data Transfer Agreement

An Australian law-compliant agreement governing data transfers between entities within the same corporate group, ensuring privacy law compliance and operational efficiency.

find out more

Data Management Agreement

An Australian law-governed agreement establishing data management and protection obligations between parties, ensuring compliance with Privacy Act 1988 and related legislation.

find out more

Intercompany Data Processing Agreement

An Australian law-governed agreement regulating data processing activities between related companies within the same corporate group.

find out more

Controller To Controller DPA

An Australian law-compliant agreement governing personal data sharing between two independent data controllers, ensuring Privacy Act compliance and data protection.

find out more

Intercompany Data Sharing Agreement

An Australian-law governed agreement for regulated data sharing between related corporate entities, incorporating privacy law compliance and data protection measures.

find out more

DPA Agreement

An Australian-law compliant agreement governing personal information processing between controllers and processors, ensuring adherence to the Privacy Act 1988 and APPs.

find out more

Third Party Data Processing Agreement

An Australian-compliant agreement governing the processing of personal information by third-party service providers under Privacy Act 1988 and APPs.

find out more

Data Transfer Addendum

An Australian law-compliant addendum governing data transfer arrangements between parties, ensuring compliance with the Privacy Act 1988 and APPs.

find out more

Supplier Data Processing Agreement

An Australian-law governed agreement setting out terms for processing personal information between an organization and its supplier, ensuring compliance with Australian privacy laws.

find out more

Controller Processor Agreement

An Australian law-compliant agreement governing the processing of personal data between a controller and processor, aligned with the Privacy Act 1988 and APPs.

find out more

Order Processing Agreement

An Australian-law governed agreement establishing terms for order processing services, including operational procedures, compliance requirements, and service levels.

find out more

Data Protection Agreement For Employees

An Australian-compliant employee data protection agreement establishing rights and obligations for handling personal information in the employment context.

find out more

Affiliate Addendum

An Australian law-governed addendum establishing terms and conditions for affiliate marketing relationships, including commercial terms and compliance requirements.

find out more

Sub Processing Agreement

An Australian-law governed agreement that establishes terms for sub-processing of personal data, ensuring compliance with privacy laws and data protection requirements.

find out more

International Data Transfer Agreement

An Australian law-compliant agreement governing cross-border data transfers, ensuring protection of personal information under the Privacy Act 1988 and APPs.

find out more

Data Transfer Agreement

An Australian law-governed agreement establishing terms for secure and compliant data transfer between organizations, ensuring adherence to Australian privacy regulations.

find out more

Download our whitepaper on the future of AI in Legal

By providing your email address you are consenting to our Privacy Notice.
Thank you for downloading our whitepaper. This should arrive in your inbox shortly. In the meantime, why not jump straight to a section that interests you here: https://www.genieai.co/our-research
Oops! Something went wrong while submitting the form.

Genie’s Security Promise

Genie is the safest place to draft. Here’s how we prioritise your privacy and security.

Your documents are private:

We do not train on your data; Genie’s AI improves independently

All data stored on Genie is private to your organisation

Your documents are protected:

Your documents are protected by ultra-secure 256-bit encryption

Our bank-grade security infrastructure undergoes regular external audits

We are ISO27001 certified, so your data is secure

Organizational security

You retain IP ownership of your documents

You have full control over your data and who gets to see it

Innovation in privacy:

Genie partnered with the Computational Privacy Department at Imperial College London

Together, we ran a £1 million research project on privacy and anonymity in legal contracts

Want to know more?

Visit our Trust Centre for more details and real-time security updates.

Read our Privacy Policy.