A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except—
on instructions from the controller, or
to comply with a legal obligation.
Section 106: Processing under the authority of the controller or processor
Data Protection Act 2018 · 2018 c. 12View on legislation.gov.uk
Part 4: Intelligence services processing — CHAPTER 4: Controller and processor
About this text
This legislation text comes from legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. These source and reuse terms cover the legislation text, not Remedy's commentary.
Reuse reviewed 21 August 2026 under Open Government Licence v3.0.