Data Protection Act 2018 (c. 12)

PART 3 U.K. Law enforcement processing

CHAPTER 4 U.K. Controller and processor

General obligations U.K.

60 Processing under the authority of the controller or processor U.K.

A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except—

(a) on instructions from the controller, or

(b) to comply with a legal obligation.