In temporary agency work the relationship between the temporary work agency and the user-undertaking is often not adequately or correctly understood in the context of the processing of personal data. This leads to a deterioration of protection of personal data as well as labour market rights and obligations. The purpose of this study is to explore when we can speak about a controller- processor, a joint controller or a controller- controller relationship, which will clarify who has to implement appropriate technical and organisational measures to ensure and to be able to demonstrate that the processing is performed in accordance with the Regulation.