---
title: "Art. 29 GDPR: Processing under the authority of the controller or processor"
canonical: "https://dposchool.com/gdpr/article/29"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_29"
source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Art. 29 GDPR · Chapter IV: Controller and processor · Section 1: General obligations

# Article 29 GDPR: Processing under the authority of the controller or processor

Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

## Summary (not the official text)

The processor and anyone acting under the authority of the controller or processor who has access to personal data may process those data only on instructions from the controller, unless required to do so by Union or Member State law.

## Official text

The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law.

## Source

Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu

[Article 29 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_29)

Text as of 28 October 2026.

This is reference material, not legal advice.

## Related recitals

This list is under review.

- [Recital 81](https://dposchool.com/gdpr/recital/81)

## Court of Justice judgments

### [C-741/21, GP v juris GmbH](https://dposchool.com/gdpr/case/c-741-21)

Judgment of 11 April 2024 · ECLI:EU:C:2024:288

Infringement alone is not damage; the controller cannot escape liability by blaming an employee acting under its authority; fine criteria in Art. 83 are not used to set damages.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-741/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0741)

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Chapter IV](https://dposchool.com/gdpr/chapter/4) / Article 29

Previous: [Art. 28 GDPR: Processor](https://dposchool.com/gdpr/article/28)

Next: [Art. 30 GDPR: Records of processing activities](https://dposchool.com/gdpr/article/30)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents