Article 29. Carrying out processing activities under the authority of the controller or the processor

The processor and any person acting under the authority of the controller or of the processor who has access to personal data shall not process those data except on instructions from the controller, unless normative acts require the processing of the data.