Article 27

The processor and any person acting under the authority of the controller or of the processor who has access to personal data shall not process them except on instructions from the controller, unless required to do so by Union or Member State law.

[Source: October 2013]

Article 27

The processor and any person acting under the authority of the controller or of the processor who has access to personal data shall not process them except on instructions from the controller, unless required to do so by Union or Member State law.

[Source: January 2012 | Context: Proposal from the European Commission]

Chapter II General rules on the lawfulness of the processing of personal data

Section VIII Confidentiality and security of processing

Article 16 Confidentiality of processing

Any person acting under the authority of the controller or of the processor, including the processor himself, who has access to personal data must not process them except on instructions from the controller, unless he is required to do so by law.