Running an AI chatbot or lead list together with another business? A GDPR Article 26 joint controller sheet for small businesses
What you get: a finished joint controller sheet in three tabs: a "who decides?" test with one row per shared activity and a result formula, an arrangement tab that names who does each GDPR duty (privacy notice, requests, breaches, security, records) with a status formula, and the "essence" text you show people, plus two made-up example rows.
Short answer: when you and another business together decide why and how personal data are used, for example a co-run AI chatbot, a shared lead list for a joint campaign or a franchise-wide CRM, Article 26 GDPR makes you joint controllers. You must agree in writing who handles which duty, make the essence of that agreement available to the people concerned, and accept that they can still go to either of you.
Step 1: tab 1, the "who decides?" test (one row per shared activity)
| Column | What to write | Source |
|---|---|---|
| A. Activity | What happens with the data: "joint webinar sign-ups scored by an AI tool", "shared booking chatbot for both clinics" | Art. 4(2) |
| B. Other business | Name of the partner, franchisor, platform or supplier involved | Art. 26(1) |
| C. Data | Which personal data: contact details, chat transcripts, AI scores | Art. 30(1)(c) |
| D. We help decide why | Yes or No: do we take part in setting the purpose? | Art. 4(7) |
| E. They help decide why | Yes or No | Art. 4(7) |
| F. They act only on our instructions | Yes if they only process for us under a processor agreement and do not use the data for their own purposes | Art. 4(8), 28 |
| G. Result | =IF(F2="Yes","Processor: use a processor agreement (Art. 28)",IF(AND(D2="Yes",E2="Yes"),"Joint controllers: fill tab 2",IF(E2="Yes","Separate controllers: each meets its own duties","Check with an adviser"))) | Art. 26(1), 28; our working rule |
The formula is a first sort, not a legal conclusion. The EDPB's Guidelines 07/2020 explain that joint control can arise from a common decision or from converging decisions that complement each other, and that both parties do not need equal shares or access to all the data. If you are unsure, record the facts in columns A to F and ask.
Step 2: tab 2, the arrangement (one row per duty)
| Column | What to write | Source |
|---|---|---|
| A. Duty | One row each: privacy notice (Arts 13 and 14), access and other rights requests (Arts 15 to 22), contact point for people, lawful basis and consent records, security (Art. 32), breach notification (Arts 33 and 34), DPIA if needed (Art. 35), records (Art. 30), retention and deletion, choosing and contracting AI suppliers (Art. 28) | Art. 26(1) |
| B. Who does it | Us, Partner or Both (drop-down list) | Art. 26(1) |
| C. How the other one is told | For example "partner forwards any request to us within 3 working days" (the 3 days is your own choice) | Art. 26(1) |
| D. Due by | Date the duty must be in place or reviewed | Our working practice |
| E. Done on | Date and where it is written down (contract clause, email, shared document) | Art. 5(2) |
| F. Status | =IF(B2="","Assign an owner",IF(E2<>"","Done",IF(TODAY()>D2-7,"Due within 7 days","Open"))). The 7-day warning is our own working rule, not a legal one | Our working rule |
Put the column letters in row 1 and the first duty in row 2; the formulas assume that layout. Article 26(1) says the arrangement must set out responsibilities "in particular" for people's rights and for the information in Articles 13 and 14, so make sure those two rows are never blank.
Step 3: tab 3, the essence for people
Article 26(2) says the essence of the arrangement must be made available to the people whose data you process. A short paragraph in each privacy notice is a practical way to do it. Example wording to adapt: "For [activity], [Business A] and [Business B] are joint controllers. [Business A] provides this notice and handles requests about your data at [contact]. You can also contact [Business B] at [contact]."
What people and courts can still do
- Whatever you agree between yourselves, a person can exercise their rights against each of you (Art. 26(3)). Your contact point helps, but you cannot refuse a request because "the partner handles that".
- Where more than one controller is responsible for damage, each can be held liable for the entire damage, then claim back the other's share (Art. 82(4) and (5)). Say in the contract how you share costs.
- Joint control does not by itself give either party a lawful basis. Each activity still needs one (Art. 6).
Two example rows (made-up businesses, for illustration only)
Example 1, two physiotherapy practices sharing one AI booking chatbot: tab 1: A. shared booking chatbot · B. "Example Physio North" · C. names, phone numbers, appointment requests · D. Yes · E. Yes · F. No · G. Joint controllers. Tab 2: privacy notice, Both (one shared notice) · rights requests, Us, partner forwards within 3 working days · breach notification, the practice whose patients are affected, the other informed the same day.
Example 2, a marketing agency and a software reseller running a joint webinar: tab 1: A. webinar sign-ups scored by an AI lead tool · B. "Example Reseller Ltd" · C. names, work emails, AI score · D. Yes · E. Yes · F. No · G. Joint controllers. Tab 2: consent records, Us (we run the sign-up form) · AI supplier contract, Partner (it pays for the lead tool) · retention, Both, delete unconverted sign-ups after 6 months (their own choice).
Do this week
- List every activity where another business shares the "why" with you, including AI tools you set up together
- Run each through tab 1 and move processors to your processor agreement check
- For each joint activity, fill tab 2 with your partner and get it into the contract or a signed email
- Add the essence paragraph to your privacy notice
This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 4, 5, 6, 13, 14, 26, 28, 30, 32 to 35 and 82 and Recital 79, as published on gdpr-info.eu) and to EDPB Guidelines 07/2020 on the concepts of controller and processor. The result formula, the 7-day warning and the layout are our own working rules. National authorities and courts may take a stricter view, so check your data protection authority's guidance. Example rows are made up for illustration and do not describe any real business. Checked on 26 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
Clients often ask whether a franchise, a referral partner or a co-branded tool makes them responsible for someone else's data. Hand them tab 1 with the client AI inventory so the shared activities are visible, stay inside your professional rules and refer legal questions on.
Keep shared activities next to your AI register
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. Note each AI tool you run jointly with a partner, and attach the arrangement as an evidence record.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then add this sheet. Related: processor agreement check · Article 30 records · Article 19 recipient sheet · 72-hour breach sheet
Sources
- Article 26 GDPR, Joint controllers (with Article 4, Definitions, Article 82, Right to compensation and liability and Recital 79); official text: Regulation (EU) 2016/679
- EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.