Article 32 › 4
GDPR
The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law.
← 3 · All articles · 33 →
Source: EUR-Lex CELLAR · retrieved 2026-08-26