Article 29: Processing under the authority of the controller or processor

Praxikon tracks Article 29 (Processing under the authority of the controller or processor) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IVIn force since 25-05-2018

Official text

The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Case law (1)

11 April 2024 · C-741/21 · CJEU
juris
An infringement is not in itself non-material damage. The controller cannot escape the duty to compensate by pointing to an employee's error, and the Article 83 fining criteria do not set the amount of compensation.

Checked on 5 November 2026

← Art. 28: Processor Art. 30: Records of processing activities →

Connections

Guidelines

Guidelines 07/2020 on the concepts of controller and processor in the GDPR
2021-07-07 · final, European Data Protection Board (EDPB)

Legislation in motion

Council: Cyprus Presidency tables negotiating mandate, Coreper vote of 26 June 2026 cancelled
2026-06-22 · under negotiation, Raad van de Europese Unie, Antici-groep (vereenvoudiging) en Coreper