The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law.
Article 29
Processing under the authority of the controller or processor
Common Questions
Frequently Asked Questions
Who is covered by Article 29 of the GDPR?
It covers the processor and any person acting under the authority of the controller or of the processor who has access to personal data.
The rule follows access: anyone working under either party's authority who can reach personal data is bound by it.
Is there any exception to the instructions requirement?
Yes, one. Processing without the controller's instructions is allowed when Union or Member State law requires the person to do so.
Outside that legal obligation, the controller's instructions are the only basis Article 29 accepts.