Article 27 — Processing under Controller or Processor authority

A Processor or person acting under authority may process personal data only on instructions from the Controller unless required by applicable law.

Interpretation and application must be checked against the official text and current version.