GDPR Article 28(3)(a): a processor acts only on the controller's instructions (Regulation (EU) 2016/679, Art 28(3)(a))
A software or service company that holds its customers' tickets, chats and recordings as their processor cannot license them. Only the customer (the controller) can decide that, and the contract must allow it.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject;”
Where it was read
Also read from the same source
- GDPR Article 5(1)(b): purpose limitation (Regulation (EU) 2016/679, Art 5(1)(b))
- GDPR Article 6(1)(f): legitimate interests as a lawful basis (Regulation (EU) 2016/679, Art 6(1)(f))
- GDPR Article 6(4): compatibility test for a new purpose (Regulation (EU) 2016/679, Art 6(4))
- GDPR Recital 50: further processing and the legal basis (Regulation (EU) 2016/679, recital 50)
- GDPR Article 9(1): special categories of personal data (Regulation (EU) 2016/679, Art 9(1))
- GDPR Article 13(3): telling people before a new purpose (Regulation (EU) 2016/679, Art 13(3))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide