# Data Protection Act 2018, Section 60: Processing under the authority of the controller or processor


A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except—
(a) on instructions from the controller, or
(b) to comply with a legal obligation.

---
Source: https://www.legislation.gov.uk/ukpga/2018/12/section/60 (the official version)
Page: https://openlegislation.uk/data-protection-act-2018/section-60
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.