{
  "url": "https://openlegislation.uk/eu-regulation-2016-679/article-29",
  "json_url": "https://openlegislation.uk/eu-regulation-2016-679/article-29.json",
  "legislation": "eur/2016/679",
  "legislation_title": "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)",
  "legislation_url": "https://openlegislation.uk/eu-regulation-2016-679",
  "path": "article/29",
  "kind": "article",
  "number": "29",
  "heading": "Processing under the authority of the controller or processor",
  "text": "The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by domestic law.",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "F",
      "label": "F1",
      "text": "Words in Art. 29 substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 23 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)"
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eur/2016/679/article/29",
    "retrieved_at": "2026-11-01T14:45:51.683617+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}