The question
Who is responsible for the personal data that partners process together? Who owns what they create together? And how does what should stay secret stay secret?
In brief
Whoever decides with others on the purposes and means of processing personal data is a joint controller with them and must put that on a proper footing (Article 26 GDPR). Whoever processes only on another’s behalf is a processor (Article 28 GDPR). A work created together belongs to its co-authors jointly, and none can dispose of it alone (Section 8 Copyright Act (UrhG)). Trade secrets are protected only if their holder has taken reasonable steps to protect them.
The law
Joint controllership
Where two or more controllers jointly determine the purposes and means of processing, they are joint controllers (Article 26(1) GDPR). The Court of Justice of the EU reads this broadly. It is enough to take part in the decision and to draw a benefit of one’s own from the processing; access to the data is not required (CJEU, judgment of 5 June 2018, C-210/16, Wirtschaftsakademie; judgment of 29 July 2019, C-40/17, Fashion ID).
In cooperations this is common: a joint event with joint registration, a shared contact database, a joint research project. The partners must then set out in an arrangement who fulfils which obligations, in particular towards the data subjects. The essence of the arrangement must be made available to them (Article 26(2) GDPR), and they may exercise their rights against each controller (Article 26(3) GDPR).
The arrangement is more than a formality. It makes the partners get clear about their joint processing, and that is often the first time they agree on what they are actually doing together.
Processing on behalf of others
Whoever processes data only on behalf of and on the instructions of another is a processor. A contract with the content required by Article 28(3) GDPR is then needed; it may be concluded electronically (Article 28(9) GDPR). Typical processors are providers of hosting, video calls or cloud storage.
The line is not always easy to draw. A provider that pursues purposes of its own is no longer merely a processor. And often the partners in a cooperation are neither joint controllers nor processors for each other, but each solely responsible for their own processing.
Co-authorship and shared results
Where several people have created a work together and their shares cannot be exploited separately, they are co-authors (Section 8(1) UrhG). The right to publish and exploit the work belongs to them jointly, and changes require everyone’s consent. A co-author may not, however, refuse consent contrary to good faith (Section 8(2) UrhG). Income is shared according to the extent of each contribution unless agreed otherwise (Section 8(3) UrhG). Where the contributions can be exploited separately, such as the words and music of a song, the works are merely combined (Section 9 UrhG).
The statute thus binds co-authors into a small cooperation with a built-in duty of loyalty. For a cooperation that wants to use its results, that is rarely enough. The partners should agree in advance who receives which rights of use, whether results will be published, who files for protection and what applies after the cooperation ends. Joint inventions follow their own rule: the right to the patent belongs to the inventors jointly (Section 6 sentence 2 Patent Act (PatG)). Computer programs written by employees in the course of their duties may be exploited by the employer (Section 69b UrhG).
There is no ownership of data as such. The contract governs who may access which data. For data generated by connected products, the Data Act (Regulation (EU) 2023/2854) has given users their own access rights since 12 September 2025.
Open-source licences as the law of cooperation
Free software and open content show how licences make cooperation possible among people who do not know one another. German copyright law expressly allows an author to grant a non-exclusive right of use to everyone free of charge (Section 32(3) sentence 3 UrhG). Permissive licences such as MIT or Apache 2.0 allow almost any use with attribution. Copyleft licences such as the GNU GPL require adaptations to be passed on under the same terms.
Copyleft is a legal form of reciprocity: whoever takes gives back, and the common stock grows. For one’s own cooperation it is worth asking whether its results should be shared in this sense. Anyone accepting contributions from many should also settle under which licence they are made.
Trade secrets
Under Section 2 no. 1 Trade Secrets Act (GeschGehG), a trade secret is information that is not generally known and therefore of economic value, that is subject to reasonable secrecy measures by its lawful holder, and in whose confidentiality there is a legitimate interest. The second condition is decisive. Whoever does not protect their information loses the protection of the statute.
In a cooperation this means non-disclosure agreements, access only for those who need it, marking confidential documents and a rule for the end of the cooperation. The measures must be reasonable, not perfect. What a partner learns by examining or taking apart a freely available product is in principle permitted unless otherwise agreed (Section 3(1) no. 2 GeschGehG).
Online
Cooperation online takes place in shared workspaces: shared folders, documents, boards, channels. All the questions on this page meet there.
Who is responsible. The workspace is usually the responsibility of whoever sets it up and decides its purpose, or of the partners jointly if they set it up together. The tool provider is normally a processor. If it uses the data for its own purposes, it becomes a controller itself.
Who has access. Personal accounts, roles and rights as needed, and an orderly exit when someone leaves the cooperation: this is at once data security (Article 32 GDPR) and reasonable secrecy within the meaning of the GeschGehG. An account not closed is an open door.
Where the data goes. Third-party tools often process data outside the EU. Transfers to third countries need a basis under Articles 44 et seq. GDPR, such as an adequacy decision, like the one for certified companies in the United States, or standard contractual clauses.
What is recorded. Recording a video call requires the consent of those taking part. Secretly recording words spoken in private is a criminal offence in Germany (Section 201 Criminal Code (StGB)).
Who owns the documents. Documents edited together easily give rise to co-authorship. A clause in the cooperation agreement or an open licence for the workspace creates clarity before it is needed.
Relevant phases
- Establishing contact: confidentiality before the contract.
- Agreeing the cooperation: rights to results, data protection arrangements.
- Starting the cooperation: workspace, access, tools.
- Ending the cooperation: closing access, dividing data and rights.
Read on: The cooperation agreement · Cooperative clauses · Good practice for working together online
Limits of this overview
This page shows the basic structures. Employee data protection, patent law, employee inventions and the details of the Data Act are not covered.
As at 30 September 2026