Who Holds the Reins? Data Controller and Processor Roles in Joint Public Service Delivery

Shared services frequently blur the line between the body that decides why data is used and the supplier that operates the system. That distinction is not academic. It determines who answers a subject access request, who notifies the Information Commissioner's Office, who bears the risk of unlawful processing and how audit rights operate. When councils, shared service bodies and private suppliers work together, the data roles need to be settled before the service goes live, not after an incident.

The starting point: purpose and means

Under the UK GDPR and the Data Protection Act 2018, a controller determines the purposes and means of processing. A processor acts on the controller's instructions. Joint controllers share the determination of purposes and means, even if they do not share every decision equally. The labels in a contract are relevant, but they are not conclusive. Regulators and courts look at what the parties actually do.

A useful test is to ask who decides why the data is processed and which material elements of the processing are chosen. If a supplier provides a hosted case management system but the authority decides which citizens are assessed, what eligibility rules apply and how long records are kept, the authority is likely to be the controller and the supplier a processor. If the supplier uses the data for its own purposes, such as product improvement or fraud analytics, a processor label becomes difficult to sustain.

Common patterns in shared delivery

Shared service arrangements take several forms. In a straightforward outsourced service, a single council may remain controller while the supplier processes data on its behalf. In a jointly owned shared service, two or more councils may act as joint controllers for common processes, with the delivery body acting as a processor or as a separate controller for its own statutory functions. In a public-private partnership, the private party may be a processor for some activities and a controller for others, such as its own health and safety or financial records.

The difficult cases are often mixed. A supplier may host a platform, provide analytics and also make operational decisions about case prioritisation. A shared service body may employ staff who exercise discretion over individual cases. A sub-contractor may receive data directly from the authority rather than through the prime supplier. Each of these patterns requires a role map that follows the data, not just the contract hierarchy.

Contract terms that match the role

Where a supplier is a processor, the contract should include the Article 28 requirements: processing only on documented instructions, confidentiality, security, sub-processor controls, assistance with data subject rights and breach notification, deletion or return of data at the end of the contract, and audit cooperation. The instructions should be specific enough to be workable. A schedule that simply says 'process in accordance with applicable law' gives little practical guidance and may not satisfy the requirement for documented instructions.

Where two or more public bodies are joint controllers, an Article 26 arrangement should allocate responsibilities transparently. It should identify who handles subject access requests, who manages breaches, who communicates with data subjects and how complaints are handled. It does not remove either party's responsibility to data subjects, but it provides an operational route through shared obligations.

Where a party is an independent controller, the contract should not pretend otherwise. A data sharing agreement or controller-to-controller terms can set out permitted purposes, security expectations, retention and onward sharing. The authority should avoid using processor clauses to control a party that is actually making its own decisions; that mismatch can create false assurance and obscure real accountability.

Breach response when responsibilities are split

A personal data breach tests the role map quickly. A processor must notify the controller without undue delay after becoming aware of a breach. The controller then decides whether to notify the ICO within 72 hours, where the threshold is met, and whether to inform affected individuals. If the supplier is a joint controller, the arrangement should state who leads the assessment and how the 72-hour clock will be managed jointly.

The contract should require more than a notification. It should specify what information the supplier must provide, who the authority's contact point is, how the supplier will support containment and remediation, and whether the supplier bears costs associated with the incident. For complex shared services, a joint incident response protocol can be more useful than a single clause. It should be tested through exercises, not left in a drawer.

Audit, assurance and exit

Audit rights are often weakest where they are most needed. A controller should be able to verify a processor's compliance, whether through reports, questionnaires, on-site audits or a combination. The right should survive sub-contracting and should not be limited to a once-a-year paper exercise. Where a supplier relies on certifications, the authority should check the scope and currency of those certifications rather than treating them as a complete answer.

Exit is another pressure point. The contract should explain how data is returned or deleted, how archives and backups are handled, how litigation holds are preserved and how the authority obtains assurance that deletion has occurred. In shared services, exit planning should also address the position of joint controllers and any shared datasets that cannot simply be divided.

A practical route map

First, map the data flows and the actual decisions taken at each stage. Second, assign a role to each party for each processing activity, recognising that one party can hold different roles for different activities. Third, draft contract terms that match those roles and avoid relying on labels alone. Fourth, allocate breach response, subject access requests, complaints and audit cooperation in operational terms. Fifth, review the model when services change, suppliers are replaced or new analytics are introduced.

The central question is not which party has the most contractual leverage. It is which party decides what happens to citizen data. Once that is clear, the contract can allocate responsibilities honestly, and the shared service can operate with a defensible account of who is accountable for what.