Source: OJ L 119, 4.5.2016, pp. 1–88 · Consolidated text

Artikel 29 Verarbeitung unter der Aufsicht des Verantwortlichen oder des Auftragsverarbeiters

Summary What does Article 29 of the GDPR regulation say?

This is a notably brief but important article that reinforces the boundary of authority within the data processing chain.

It establishes that processors, and anyone else who acts under the direction of either the controller or the processor, are not free agents when it comes to handling personal data.

Their processing activities must stay within the boundaries set by the controller's instructions.

The only exception to this is where Union or Member State law independently requires them to act.

This article connects closely to Article 28, which sets out the formal contractual relationship between controllers and processors, and Article 29 can be seen as the operational expression of that relationship in practice.

Important points:

Processors and anyone acting under the authority of a controller or processor must only process personal data on the instructions of the controller.
The sole exception is where Union or Member State law requires processing beyond those instructions.
This obligation extends beyond the processor itself to any individual person who has access to personal data within that structure.

Springlex's summary of the article is a reading aid, not a substitute for the legal text.

Der Auftragsverarbeiter und jede dem Verantwortlichen oder dem Auftragsverarbeiter unterstellte Person, die Zugang zu personenbezogenen Daten hat, dürfen diese Daten ausschließlich auf Weisung des Verantwortlichen verarbeiten, es sei denn, dass sie nach dem Unionsrecht oder dem Recht der Mitgliedstaaten zur Verarbeitung verpflichtet sind.

Table of contents

Springlex and this text is meant purely as a documentation tool and has no legal effect. No liability is assumed for its content. The authentic version of this act is the one published in the Official Journal of the European Union.