Artikel 29 Behandling under den personuppgiftsansvariges eller personuppgiftsbiträdets överinseende

This is a notably brief but important article that reinforces the boundary of authority within the data processing chain.

It establishes that processors, and anyone else who acts under the direction of either the controller or the processor, are not free agents when it comes to handling personal data.

Their processing activities must stay within the boundaries set by the controller's instructions.

The only exception to this is where Union or Member State law independently requires them to act.

This article connects closely to Article 28, which sets out the formal contractual relationship between controllers and processors, and Article 29 can be seen as the operational expression of that relationship in practice.

Important points:

• Processors and anyone acting under the authority of a controller or processor must only process personal data on the instructions of the controller.
• The sole exception is where Union or Member State law requires processing beyond those instructions.
• This obligation extends beyond the processor itself to any individual person who has access to personal data within that structure.