Art. 29 GDPR · Chapter IV: Controller and processor · Section 1: General obligations
Article 29 GDPR: Processing under the authority of the controller or processor
Text as of 28 October 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the official text)
The processor and anyone acting under the authority of the controller or processor who has access to personal data may process those data only on instructions from the controller, unless required to do so by Union or Member State law.
Official text
The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law.
Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu
Text as of 28 October 2026.
This is reference material, not legal advice.
Related recitals
This list is under review.
Court of Justice judgments
- C-741/21, GP v juris GmbH
Judgment of 11 April 2024ECLI:EU:C:2024:288
Infringement alone is not damage; the controller cannot escape liability by blaming an employee acting under its authority; fine criteria in Art. 83 are not used to set damages.