{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2016-05-04","gaps":[],"covered":["GDPR L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/gdpr/articles/29","url":"https://www.headlesslaw.com/gdpr/articles/29","title":"Article 29 — Processing under the authority of the controller or processor","family":"l1_generated","work_id":"gdpr","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":"2018-05-25","application":{"state":"applicable","next":null,"dates":[{"at":"2018-05-25","note":"Article 99(2)"}]},"version_label":"Consolidated version of 4 May 2016","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504","valid_from":"2016-05-04","valid_until":"2018-05-25","revision":1,"content_id":"ee8363ec378d8ec5","change_date":null,"nearest_versions":["2016-05-04"],"first_text_date":"2016-04-27","correction_applies":false,"versions":["2016-05-04"],"version_url":"https://www.headlesslaw.com/gdpr/articles/29/versions/2016-05-04","revision_url":"https://www.headlesslaw.com/gdpr/articles/29/versions/2016-05-04/rev/ee8363ec378d8ec5","versions_url":"https://www.headlesslaw.com/gdpr/articles/29/versions","relations_url":"https://www.headlesslaw.com/gdpr/articles/29/relations","source_line":null,"attribution":null},"provenance":{"official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/gdpr/articles/29.md","body_sha256":"be71fefb6d7b16ee00cf7797427a87aa51c481478f225236300195ca44041e3e"},"units":[{"locator":"gdpr/art/29","kind":"article","status":"in_force","label":null,"heading":"Processing under the authority of the controller or processor","text":"","marks":[],"revision":1,"text_hash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","reason":null},{"locator":"gdpr/art/29/subpara/1","kind":"subparagraph","status":"in_force","label":null,"heading":null,"text":"The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law.","marks":[],"revision":1,"text_hash":"ceda1cdc301b9cc2cdd95d5e1db6e18196f61c2430307f0d5280e1abffb754c3","reason":null}],"markdown":"---\ntitle: \"Article 29 — Processing under the authority of the controller or processor\"\ntype: regulation\nlegal_status: in_force\nsource: \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504\"\nsource_retrieved: 2026-09-28\nshortTitle: \"Article 29 — Processing under the authority of the controller or processor\"\ninstrument_type: level1_regulation\nauthority: Commission\nbinding: true\nbinding_character: binding\nmica_level2: false\nlegal_basis: \"Regulation (EU) 2016/679\"\ninstrument: gdpr\ncelex: \"32016R0679\"\nregulation: GDPR\nregulation-full: \"Regulation (EU) 2016/679\"\narticle: 29\nstatus: in_force\nobject_id: eu.gdpr.legal_text.article.29\ntext_version: \"Consolidated version of 4 May 2016\"\nsource_url: \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\n---\n\n*In force · Consolidated version of 4 May 2016 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504)*\n\nThe [processor](https://www.headlesslaw.com/definitions/gdpr/processor) and any person acting under the authority of the [controller](https://www.headlesslaw.com/definitions/gdpr/controller) or of the processor, who has access to [personal data](https://www.headlesslaw.com/definitions/gdpr/personal-data), shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law.\n\n## Related Level 2 and Level 3\n\n### Guidance and Q&A\n\n- [EDPB 07/2020 — Guideline — Controller/processor \\[final\\]](../level-3/guidelines/edpb-07-2020-controller-processor.md)\n\n***\n\n[Chapter IV — Controller and processor](../chapters/iv.md) · [← Article 28](28.md) · [Article 30 →](30.md)\n"}