Skip to content
← GDPR: overview of provisions

Regulation (EU) 2016/679 (GDPR) · Chapter IV · Controller and processor

Art. 29 · Processing under the authority of the controller or processor

Text

The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law.

Text: EUR-Lex, CELEX 32016R0679 (consolidated text with corrigenda).

Commentary

Anyone with access to the data processes it only on the controller's instructions.

How content is made

Content is produced in the Legal To Code legal workflow for Claude Code (version 1.131.0). Cited provisions are verified against a local library of their verbatim wording. Where the wording is not in the library, it is verified in the Czech Collection of Laws. For case-law research the workflow is connected to the Salvia MCP server. Automated checks of citations and internal consistency are part of the workflow. Even those checks do not rule out an error. Verify decisive information against the original sources.

How this works · What has changed