7.2.7 Joint PII controller
Where the organization is a joint controller, it must determine the respective roles and responsibilities for processing, including privacy and security requirements, transparently and in a contract or similar binding do
5
artefacts
0
held by a system
1
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Named contact point for individuals and evidence it is reachable · Document repository
governing documentDocuments that govern the control
- Binding joint controller agreement covering each of the matters the standard lists · Vendor register / contract repository
- Identification of every joint controller relationship, distinguished from processor relationships · Document repository
- Breach responsibility allocation naming who notifies whom and within what time · Document repository
- Information made available to individuals about the essence of the arrangement · Document repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Joint controllership misclassified as a processor relationship, so the wrong contract terms apply
- Agreement covering commercial matters while breach notification and obligations to individuals are unaddressed
- No contact point, leaving individuals to guess which party to approach
- Arrangement never disclosed to individuals in any form
- Retention terms unstated, so each party retains on its own schedule
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet7.2.6 Contracts with PII processors · 7.2.8 Records related to processing PII