# GDPR Article 29: Processing under the authority of the controller or processor

General Data Protection Regulation (GDPR), version 2026.1, in force since 25 May 2018. Read from https://publications.europa.eu/resource/celex/02016R0679-20160504. Each clause starts with its key, which is how to cite it.

## gdpr:art-29

The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law.

Page: https://dpolens.com/laws/gdpr/art-29