Member States may regulate certain conditions of joint controllers and processors. This follows from 4 opening clauses:

Art. 26 I 2: Determination of respective responsibilities of joint controllers

 

Art. 28 III a: Processor’s requirements to process data (irrespective of constructions from the controller)

 

Art. 28 III g: Processor's requirements to store data (irrespective of the end of the provision of services)

 

Art. 29: Processing under the authority of the controller or processor