All Countries
Compliance
Joint Controller Data Processing Agreement

Joint Controller Data Processing Agreement Template for Germany

Create a bespoke document in minutes,  or upload and review your own.

4.6 / 5
4.8 / 5

Let's create your Joint Controller Data Processing Agreement

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Get your first 2 documents free

Your data doesn't train Genie's AI

You keep IP ownership of your information

Key Requirements PROMPT example:

Joint Controller Data Processing Agreement

"I need a Joint Controller Data Processing Agreement for a healthcare research collaboration between our hospital and a medical AI company, with specific provisions for handling sensitive patient data and research findings, to be implemented by March 2025."

Celebrated by
Collaborations with
Investors
Document background
A Joint Controller Data Processing Agreement is required when two or more organizations jointly determine the purposes and means of processing personal data under German law and GDPR. This document is essential for compliance with Article 26 GDPR and the German Federal Data Protection Act (BDSG), particularly in scenarios such as shared platforms, joint ventures, or collaborative projects involving personal data processing. The agreement must clearly delineate each controller's responsibilities for ensuring GDPR compliance, handling data subject requests, implementing security measures, and managing breach notifications. It should reflect the specific arrangements between the parties while ensuring transparency towards data subjects about their respective roles and responsibilities.
Suggested Sections

1. Parties: Identification and details of the joint controllers entering into the agreement

2. Background: Context of the joint processing activities and purpose of the agreement

3. Definitions: Definitions of key terms used in the agreement, including those from GDPR Article 4 and additional relevant terms

4. Scope and Purpose: Detailed description of the joint processing activities and their purposes

5. Roles and Responsibilities: Allocation of responsibilities between joint controllers for GDPR compliance and data subject rights

6. Transparency Measures: Arrangements for providing information to data subjects about joint processing

7. Data Subject Rights: Procedures for handling data subject requests and determining controller responsibility

8. Security Measures: Technical and organizational measures for data protection

9. Personal Data Breach Notification: Procedures for handling and notifying about data breaches

10. Liability and Indemnification: Distribution of liability between controllers and indemnification provisions

11. Term and Termination: Duration of the agreement and termination conditions

12. General Provisions: Standard contractual provisions including governing law, jurisdiction, and amendment procedures

Optional Sections

1. International Data Transfers: Required when personal data is transferred outside the EEA, including transfer mechanisms and safeguards

2. Processor Engagement: Include when joint controllers plan to engage common processors

3. Special Categories of Data: Required when processing special categories of personal data under Article 9 GDPR

4. Data Protection Impact Assessment: Include when processing is likely to result in high risk to rights and freedoms

5. Insurance Requirements: Include when specific insurance coverage is required due to processing risks

6. Audit Rights: Optional section detailing mutual audit rights and procedures

Suggested Schedules

1. Schedule 1 - Processing Activities: Detailed description of processing activities, categories of data subjects and personal data

2. Schedule 2 - Technical and Organizational Measures: Detailed security measures implemented by both controllers

3. Schedule 3 - Contact Points and Responsible Persons: List of key contacts and responsible persons for various aspects of the agreement

4. Schedule 4 - Data Subject Information: Template or content of privacy notice for data subjects regarding joint processing

5. Schedule 5 - Sub-processors: List of approved sub-processors if applicable

6. Appendix A - Data Flow Diagram: Visual representation of data flows between controllers and any processors

Authors

Alex Denne

Head of Growth (Open Source Law) @ Genie AI | 3 x UCL-Certified in Contract Law & Drafting | 4+ Years Managing 1M+ Legal Documents | Serial Founder & Legal AI Author

Linkedin in social icon imageX social icon image
alex.den.21@genieai.co
Relevant legal definitions
Agreement
Authorized Personnel
BDSG
Business Day
Controller
Data Protection Laws
Data Protection Officer
Data Subject
Data Subject Rights
EEA
Force Majeure
GDPR
Joint Processing Activities
Joint Purposes
Lead Controller
Material Change
Personal Data
Personal Data Breach
Processing
Processor
Professional Fees
Reasonable Endeavours
Receiving Controller
Representative
Restricted Transfer
Security Measures
Special Categories of Personal Data
Sub-processor
Supervisory Authority
Technical and Organizational Measures
Term
Third Party
Transfer Mechanisms
Working Day
Working Hours
Relevant Industries

Technology

Healthcare

Financial Services

E-commerce

Education

Professional Services

Marketing and Advertising

Research and Development

Telecommunications

Insurance

Real Estate

Retail

Manufacturing

Transportation and Logistics

Relevant Teams

Legal

Compliance

Information Security

Data Protection

Information Technology

Risk Management

Operations

Project Management

Business Development

Procurement

Relevant Roles

Data Protection Officer

Chief Privacy Officer

Legal Counsel

Compliance Manager

Information Security Manager

Risk Manager

Project Manager

IT Director

Chief Information Officer

Chief Technology Officer

Operations Manager

Contract Manager

Privacy Analyst

Data Protection Specialist

Chief Legal Officer

Business Development Manager

Industries
General Data Protection Regulation (GDPR): The primary EU regulation governing data protection and privacy, particularly Article 26 which specifically addresses joint controllers and their obligations to determine their respective responsibilities
Bundesdatenschutzgesetz (BDSG): The German Federal Data Protection Act that implements the GDPR and provides additional national requirements for data protection in Germany
Bürgerliches Gesetzbuch (BGB): The German Civil Code which provides the general framework for contracts and legal transactions in Germany
Telemediengesetz (TMG): The German Telemedia Act which may be relevant if the joint processing involves online services or electronic communications
EU Standard Contractual Clauses for Controllers: While not legislation per se, these provide important guidance for structuring controller relationships and may be relevant for consistency in approach
Teams

Employer, Employee, Start Date, Job Title, Department, Location, Probationary Period, Notice Period, Salary, Overtime, Vacation Pay, Statutory Holidays, Benefits, Bonus, Expenses, Working Hours, Rest Breaks,  Leaves of Absence, Confidentiality, Intellectual Property, Non-Solicitation, Non-Competition, Code of Conduct, Termination,  Severance Pay, Governing Law, Entire Agreemen

Find the exact document you need

Intra Group Agreement Data Protection

German law-governed data protection agreement regulating personal data processing between group companies, ensuring GDPR and BDSG compliance.

find out more

Data Privacy Agreement

A German law-governed agreement establishing terms for personal data processing between controller and processor, ensuring GDPR and BDSG compliance.

find out more

Joint Controller Data Processing Agreement

German law-governed agreement establishing responsibilities between joint controllers under GDPR Article 26 and BDSG requirements.

find out more

Controller To Controller Agreement GDPR

A German law-governed agreement establishing data sharing terms between two controllers under GDPR compliance requirements.

find out more

Data Controller DPA

German law-governed Data Processing Agreement establishing terms for personal data processing under GDPR and BDSG requirements.

find out more

Proprietary Data Protection Agreement

A German law-governed agreement for protecting proprietary data and ensuring compliance with GDPR, BDSG, and German Trade Secrets Act requirements.

find out more

Master Data Protection Agreement

A German law-governed data processing agreement establishing GDPR and BDSG-compliant terms between data controller and processor.

find out more

Commissioned Data Processing Agreement

A German law-governed agreement between a data controller and processor establishing terms for GDPR-compliant personal data processing.

find out more

Supplier Data Processing Agreement

A German law-governed data processing agreement between controller and processor, ensuring GDPR and BDSG compliance for supplier relationships involving personal data processing.

find out more

Data Protection Agreement For Employees

A German law-governed agreement establishing data protection rules between employer and employee under GDPR and BDSG requirements.

find out more

Data Privacy Addendum

A German law-governed addendum establishing data protection obligations and responsibilities under GDPR and BDSG requirements.

find out more

Non Disclosure Agreement Data Protection

German-law governed NDA incorporating GDPR and BDSG data protection requirements for protecting both confidential information and personal data.

find out more

Data Protection Addendum

A German law-governed agreement establishing data processing terms between controllers and processors, ensuring compliance with GDPR and German data protection requirements.

find out more

Confidentiality Agreement Data Protection

German law-governed Confidentiality Agreement with integrated GDPR and data protection provisions for secure handling of confidential information and personal data.

find out more

Download our whitepaper on the future of AI in Legal

By providing your email address you are consenting to our Privacy Notice.
Thank you for downloading our whitepaper. This should arrive in your inbox shortly. In the meantime, why not jump straight to a section that interests you here: https://www.genieai.co/our-research
Oops! Something went wrong while submitting the form.

Genie’s Security Promise

Genie is the safest place to draft. Here’s how we prioritise your privacy and security.

Your documents are private:

We do not train on your data; Genie’s AI improves independently

All data stored on Genie is private to your organisation

Your documents are protected:

Your documents are protected by ultra-secure 256-bit encryption

Our bank-grade security infrastructure undergoes regular external audits

We are ISO27001 certified, so your data is secure

Organizational security

You retain IP ownership of your documents

You have full control over your data and who gets to see it

Innovation in privacy:

Genie partnered with the Computational Privacy Department at Imperial College London

Together, we ran a £1 million research project on privacy and anonymity in legal contracts

Want to know more?

Visit our Trust Centre for more details and real-time security updates.

Read our Privacy Policy.