Joint-controller subject access request arrangement

This arrangement applies only where [school name] is a joint controller with one or more other organisations for the processing described as [processing description].

Joint controllers and processing

The joint controllers covered by this arrangement are [school name] and [joint controller name]. The arrangement applies to the relevant processing activities described as [processing description].

The arrangement reflects the actual controllers, processing activities, contact routes and allocation of responsibilities for this processing.

Receiving a subject access request

A subject access request may be made to [school name], to another controller covered by this arrangement, or through the central contact route [central contact route] where that route is used.

A request received by [school name] will be allocated and coordinated in accordance with the responsibilities recorded in this arrangement. A request received by another controller will be handled in accordance with the responsibilities recorded by the joint controllers.

Allocation and coordination

The role responsible for coordinating the arrangement for [school name] is [arrangement owner role].

The joint controllers will record how requests are allocated, how information is coordinated between the controllers, and which controller or controllers will respond to each relevant part of a request.

The allocation for the processing covered by this arrangement is maintained between [school name] and [joint controller name] and is applied according to the actual request, the relevant processing activities and the responsibilities agreed by the controllers.

Contact routes

The contact route for exercising rights against [school name] is [school contact route].

The contact route for exercising rights against [joint controller name] is [joint controller contact route].

Where a central contact point is used, it is [central contact route]. Use of a central contact point does not prevent an individual from exercising their rights against [school name] or any other relevant controller.

Responding to requests

The controllers will coordinate the handling of each relevant subject access request in accordance with the allocation recorded in this arrangement.

The response route for a request will be identified for the particular request and will reflect the controller or controllers responsible for the relevant processing.

An individual may exercise their rights against each relevant controller, including [school name], whether or not a central contact point is provided.

Ownership and adoption

The responsible role for maintaining this arrangement on behalf of [school name] is [arrangement owner role].

This arrangement takes effect from [effective date] and must be kept aligned with the actual joint controllers, relevant processing activities, allocation of responsibilities and contact routes.