Art.29 Processing under the authority of the controller or processor
The processor, and any person acting under the authority of the controller or of the processor who has access to personal data, must not process that data except on instructions from the controller, unless required to do so by Union or Member State law.
Source: GDPR, Art.29. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open GDPR in the compliance library.
Many articles apply only where their condition is met (a data protection officer under Article 37, an impact assessment under Article 35, a representative under Article 27); the condition is in each statement.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Monitoring or logging capable of detecting processing outside instruction, and records of any detection · SIEM / log platform
- Where a legal requirement overrides instructions, the record of the requirement and the notification given to the controller · Document repository
governing documentDocuments that govern the control
- The documented instructions issued to each processor, and the mechanism by which they are kept current · Document repository
- Employment or contract terms binding staff and contractors to process personal data only as instructed · Vendor register / contract repository
- Access controls that make the technical scope of access match the instructions actually given · Policy repository / GRC workspace
First move
Common gaps auditors find
- Instructions existing only as the original contract, never updated as the processing changed over years of service
- Staff holding broad standing access to production personal data far beyond what their instructed tasks require
- No means of detecting processing outside instruction, so the obligation is asserted and never tested
- Processor use of controller data for its own purposes, such as service improvement or model training, permitted by a clause nobody negotiated
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet