A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except—
(a)on instructions from the controller, or
(b)to comply with a legal obligation.
Commencement Information
I1S. 60 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)