PART 3Law enforcement processing
CHAPTER 4Controller and processor
General obligations
I160Processing under the authority of the controller or processor
A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except—
a
on instructions from the controller, or
b
to comply with a legal obligation.