A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except—
(a)on instructions from the controller, or
(b)to comply with a legal obligation.