What does joint controllership mean in a wellbeing services county?

In brief

Joint controllership means that two or more controllers decide together why personal data is processed and how it is processed. In a wellbeing services county, the question is important because health and social care work often involves the same client, the same services, and highly protected client and patient data. The GDPR's Article 26 requires the joint controllers to divide their responsibilities in a transparent arrangement, especially for data subject rights and the information given to the client. The split helps internal work, but the client may still use their rights against any joint controller.

Joint controllership starts with shared decision-making

A controller is the organisation that decides the purposes and means of processing personal data. In everyday terms, the purpose is the reason for using the data, such as arranging care. The means are the main choices about how the data is used, such as what data is collected, who may access it, and what systems or records are used.

The GDPR's Article 26 sets the test for joint controllership. Joint controllership exists when at least two controllers determine the purposes and means of processing together.

This is not decided by the name used in a contract. It is decided by the real role of each organisation. If two organisations genuinely decide the core choices together, they are joint controllers for that processing. If one organisation only processes personal data for another controller, it is a processor under the GDPR's Article 4. That is a different role and usually raises the question of a processing agreement. That distinction continues in Controller or processor: when a data processing agreement is needed and what Article 28 requires.

For a wellbeing services county, the practical question is usually this: who decides the service-related purpose, the data flows, the access model, and the information given to the client. If those decisions are shared, Article 26 becomes central.

In a wellbeing services county, the question concerns specially protected data

Health and social care data is not ordinary workplace data. The GDPR's Article 4 defines health data as personal data related to a person’s physical or mental health, including data about the provision of health care services, which reveals information about health status. In practice, this can include a diagnosis, a care note, a referral, or information that a person has used a service.

The GDPR's Article 9 treats health data as a special category of personal data. Processing special categories is prohibited unless one of the Article 9 conditions applies. One condition covers processing that is necessary for health or social care treatment, or for the management of health or social care services and systems, when the legal safeguards in Article 9 are met.

The Act on the Processing of Client Data in Healthcare and Social Welfare 703/2023 adds the sector-specific rule that health and social care client data is permanently secret. Section 4 also limits disclosure of secret client data to outsiders. This means joint controllership is not a shortcut to wider access. It is a governance model for responsibility. It does not turn secret client data into shared internal material for anyone who is interested.

The GDPR's Article 5 also matters. It requires lawful, fair and transparent processing, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. In client work, this means that every shared arrangement must still answer simple questions: why the data is used, which data is necessary, who may use it, how long it is kept, and how the organisation can show that the rules were followed. The basics are explained further in What do the GDPR's six principles mean at work?.

Responsibilities must be divided so the client understands them

The GDPR's Article 26 requires joint controllers to define their respective responsibilities by a transparent arrangement. The arrangement must show the real roles and relationships of the joint controllers in relation to the data subject. Its essential parts must be available to the data subject.

This is not just a legal document for management. It must work in client service. A client should be able to understand who is responsible for the privacy notice, who receives requests, who answers access requests, and who corrects inaccurate data.

A useful responsibility split often answers at least these questions:

Responsibility	Why it matters in client work
Information to the client under GDPR Articles 13 and 14	The client must know who the controllers are, why data is processed, the legal basis, the recipients, the retention period or criteria, and the available rights.
Contact point	Article 26 allows a contact point for data subjects. This helps the client know where to start, even when more than one controller is involved.
Handling access requests under Article 15	The client may ask whether their personal data is processed and may receive access to the data and related information.
Correcting inaccurate data under Article 16	Client records affect real services. The arrangement should say who checks and corrects inaccurate or incomplete data.
Restricting processing under Article 18	If the client disputes accuracy, the organisation may need to limit use while the matter is checked.
Notifying recipients under Article 19	If data is corrected, deleted, or restricted, recipients must be told unless this is impossible or requires disproportionate effort.

The GDPR's Article 12 sets the communication standard. Information to the data subject must be concise, transparent, intelligible, easily accessible, and written in clear and plain language. Article 12 also sets the time rule for requests under Articles 15 to 22: the controller must provide information on action taken without undue delay and in any event within one month of receiving the request. That period may be extended by up to two further months where necessary, considering the complexity and number of requests.

For the client, the result should be simple. The client does not need to understand internal governance before making a request. The organisation must understand it.

Data subject rights do not depend on the internal split

The strongest rule in Article 26 is also the easiest to miss. Even if the joint controllers agree that one party handles client requests, the data subject may exercise their rights against each controller.

This means an internal responsibility split cannot be used as a reason to turn the client away. It can decide who does the work internally. It cannot remove the client’s right to contact another joint controller.

The rights that matter in daily service include:

• the right to receive transparent information under Articles 13 and 14;
• the right of access under Article 15;
• the right to rectification under Article 16;
• the right to erasure under Article 17, where the Article’s conditions are met;
• the right to restriction of processing under Article 18;
• the right to be told about recipients in the situations covered by Article 19;
• the right to data portability under Article 20, where its conditions are met.

Article 20 has an important limit. The right to data portability does not apply to processing that is necessary for performing a task carried out in the public interest or in the exercise of official authority vested in the controller. That limit matters in public health and social care work when the processing rests on a statutory task rather than consent or a contract.

For access requests, correction requests, and other client contacts, staff need a shared practical route. Otherwise the legal arrangement stays on paper and the client receives inconsistent answers. Related request handling is covered in Data subject rights: when a customer asks for their data, you have a month.

Security and access rights are part of the split

Joint controllership is not only about privacy notices and requests. It also affects security. The GDPR's Article 32 requires the controller and the processor to implement technical and organisational measures that ensure a level of security appropriate to the risk.

The examples in Article 32 include pseudonymisation and encryption, the ability to ensure confidentiality, integrity, availability and resilience, the ability to restore access after a physical or technical incident, and a process for regularly testing and evaluating security measures.

In health and social care, access control is also stated directly in the Act on the Processing of Client Data in Healthcare and Social Welfare. Section 9 requires the right to use client data to be based on the person’s work task and the service provided. The person may use only the necessary client data needed in their tasks. The basis for processing must be a technically verified client or care relationship, or another task related to arranging and providing the client’s social and health services.

Section 9 also requires the service provider and pharmacy to define what necessary client data professionals and other persons processing client data may use. They must also keep a register of users of their information systems and client registers, and of those users’ rights to use client data.

For a joint controller arrangement, this means the split of responsibilities should cover access rights, user management, and log-related working practices. A person who can see client data should have a task-based reason. Curiosity is not a task. Broad access “just in case” is hard to reconcile with necessity, secrecy, data minimisation, and confidentiality.

Security measures continue in Access control, multi-factor authentication and encryption: three measures the law names.

Not all cooperation is joint controllership

This is the limit that keeps the concept useful. Joint controllership does not arise from every form of cooperation.

If one party only processes personal data on behalf of another controller, the GDPR's Article 4 describes that party as a processor. The processor does not decide the purposes and means in the same way as a controller. If each organisation decides its own separate purpose and means, they may be separate controllers rather than joint controllers. If the responsibilities are already defined by European Union law or Member State law, Article 26 allows that legal definition to determine the responsibility areas.

Joint controllership also does not require unlimited sharing. The Act on the Processing of Client Data in Healthcare and Social Welfare, section 4, keeps client data secret. Section 9 ties access to the work task, the service, necessity, and a technically verified relationship or other service-related task. The GDPR's Article 5 requires data minimisation and confidentiality. Together, these rules point away from “everyone can see everything”.

It also does not remove the need for a legal basis. The GDPR's Article 6 requires processing to have a lawful basis. For public authority tasks, Article 6 says legitimate interests do not apply to processing carried out by public authorities in the performance of their tasks. The legal basis question is separate from the controller role question. It continues in What legal basis permits processing personal data?.

Clear responsibility split reduces errors in client work

Joint controllership becomes risky when the arrangement is vague. One unit may think another unit gave the privacy notice. One controller may assume another controller will answer the access request. A professional may believe access is allowed because the client belongs to the same wider service process, even though the task-based need is missing.

A clear split reduces these errors. It gives staff a route for client questions. It gives the data protection officer a structure for checking responsibilities. It gives management a way to show accountability under the GDPR's Article 5.

For wellbeing services counties and their partners, the practical aim is not to create more paperwork. The aim is to make shared client work understandable and controlled. The client sees where to turn. Staff know whose instructions apply. Access rights follow the task. Secret client data remains secret. The organisation can explain how the joint decision-making works and how the client’s rights are protected.