A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except -
(a) on instructions from the controller, or
(b) to comply with a legal obligation.
Version status: In force | Document consolidation status: Updated to reflect all known changes
Version date: 25 May 2018 - onwards