The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law.
Article 29
Processing under the authority of the controller and processor
Understanding This Article
Article 29 is brief but important - it ensures that individuals with data access (employees, contractors, agents) don't process data independently or outside their authorized scope.
Scope: Applies to two groups:
- Processors: Already covered by Article 28
- Any person acting under authority: Employees, contractors, agents, temporary staff - anyone working for controller or processor with data access
Core Rule: These individuals shall not process personal data except on instructions from the controller, unless legally required.
Legal Requirement Exception: If EU or Member State law requires processing (e.g., tax reporting, legal obligations), they can process without controller instruction. But this should be exceptional.
Relationship to Article 28(3)(a): Article 28 requires processor contracts to specify that processing occurs only on documented instructions. Article 29 extends this to individuals acting under authority.
Key Points
- Applies to processors and anyone acting under controller/processor authority
- Can only process on controller instructions
- Exception: processing required by EU or Member State law
- Covers employees, contractors, agents with data access
- Prevents unauthorized or independent processing
Practical Application
Who This Applies To:
- Employees of controller or processor
- Contractors and consultants
- Temporary staff
- Interns
- IT administrators
- Customer service representatives
- Anyone with system access to personal data
Implementation Requirements:
- Documented Instructions:
- Provide clear, written instructions on data processing
- Specify what data can be accessed
- Define permitted uses
- Outline prohibited activities
- Access Controls:
- Implement role-based access (least privilege)
- Restrict access to what's needed for job function
- Technical controls enforcing authorization limits
- Training:
- Train staff on data protection obligations
- Explain scope of their authorized processing
- Clarify consequences of unauthorized use
- Confidentiality:
- Confidentiality agreements (relates to Article 28(3)(b))
- Non-disclosure obligations
- Monitoring:
- Audit logs to detect unauthorized processing
- Regular access reviews
- Anomaly detection
Example 1 - Customer Service:
Customer service reps have instructions to access customer accounts only when handling support tickets. They cannot browse accounts out of curiosity, use data for personal purposes, or process it in ways not instructed.
Example 2 - IT Administrator:
IT admin has access to database for maintenance purposes. They're instructed to perform backups, updates, and troubleshooting. They cannot export customer data for personal use, analyze it for curiosity, or share it without authorization.
Example 3 - Marketing Contractor:
Marketing agency has instructions to use customer emails only for sending approved campaigns. They cannot use the email list for their own purposes, sell it to third parties, or add customers to other campaigns.
Example 4 - Legal Requirement Exception:
Payroll processor must report salary data to tax authorities as required by law. This processing occurs without specific controller instruction for each report - it's legally required.
Violations Examples:
- Employee snooping on celebrity accounts
- IT staff copying customer database for personal project
- Contractor selling data to third parties
- Using work data for personal business
- Sharing data with unauthorized parties
Enforcement Mechanisms:
- Employment contracts with data protection clauses
- Disciplinary procedures for violations
- Technical access controls
- Audit trails and monitoring
- Training and awareness
Documentation:
- Processing instructions in job descriptions
- Data access policies
- Training materials and records
- Confidentiality agreements
- Acceptable use policies