Joint controllers who jointly determine the purpose and means of processing, are required to arrange between themselves their respective responsibilities for compliance with the GDPR – and the exercise of data subjects’ rights and provision of transparency information to individuals. The arrangement must set out their roles and responsibilities and the essence of the arrangement must be made available to data subjects