A joint controller is a GDPR role used when two or more organizations together decide why personal data is processed and how that processing is carried out. It is different from a processor, which acts only on instructions. Joint controllership can arise in shared platforms, advertising ecosystems, cloud services, or AI workflows where several parties influence collection, retention, enrichment, or publication of data.
In cyber security, the role matters because it defines who must implement safeguards, answer data subject requests, maintain logs, and handle breach duties. If the responsibility split is unclear, attackers can benefit from gaps in monitoring, access control, or incident response. Defenders reduce that risk by mapping decision-making, documenting each party’s duties, and aligning security controls across the full data flow. Clear joint-controller arrangements help prove accountability when personal data moves across vendors, products, and internal teams.