One of these possibilities is joint controllership. This is a constellation provided for in Article 26 of the RGPD, which allows several companies to share and share their customer or other data. At the same time, the Institute of Common Responsibility provides clients with details of who they can contact for data protection issues. Whether there is a shared responsibility depends on the parties` joint determination of the purposes (and means) of data processing. Thank you very much! I have read ARTICLE 29 DATA PROTECTION WORKING PARTY, WP169 ([LINK MIS TO DAY]: ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2010/wp169_en.pdf) reflects on the existence of a common responsibility if it is argued that A gives the purpose, but B accepts them and claims them indirectly (without B, the processing is not carried out because B does not have the coordinates), and A gives the means (including THE TOM), but B could insist that A use certain TOMs to protect the contact data that belong to B. However, if there is only one controller or party third party report or intermediary, should there be only a commercial contract between A and B that grossly guarantees and compliance with the law, and market study participants must agree to submit their B and A data for the purposes mentioned in the contract, and A and B must protect their personal data in accordance with the RGPD, regardless of each other as responsible? (Thanks again. Dr. Data Protection, I dare again: Example No. 6 (“headhunters”) postulated in the WP169 link – too little for me – a joint control between the client and the headhunters, apparently because the headhunter can have matching enhancen by accessing his own contact database. Wouldn`t it be possible to argue that B, if file B does not contain the number of people A wants with the criteria of A, could expand its own file through free search (cold acquisition) in order to find the number of participants desired by A? And does the relationship between A and B change if B is supposed to interview the identified participants immediately after receiving an A questionnaire and send to A only the recorded interview and not the contact details of the participants? Thank you very much.