106 Processing under the authority of the controller or processor
106 Processing under the authority of the controller or processor

A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except—

(a)     on instructions from the controller, or

(b)     to comply with a legal obligation.