{
  "url": "https://openlegislation.uk/data-protection-act-2018/section-60",
  "json_url": "https://openlegislation.uk/data-protection-act-2018/section-60.json",
  "legislation": "ukpga/2018/12",
  "legislation_title": "Data Protection Act 2018",
  "legislation_url": "https://openlegislation.uk/data-protection-act-2018",
  "path": "section/60",
  "kind": "section",
  "number": "60",
  "heading": "Processing under the authority of the controller or processor",
  "text": "A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except—\n(a) on instructions from the controller, or\n(b) to comply with a legal obligation.",
  "extent": null,
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "I",
      "label": "I1",
      "text": "S. 60 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)"
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/ukpga/2018/12/section/60",
    "retrieved_at": "2026-10-28T17:00:05.588950+00:00",
    "licence": "OGL-UK-3.0",
    "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
    "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
  }
}