# Processing under the authority of the controller or processor — GDPR — context bundle > Focused context for a single provision, curated from overview.legal on 2026-08-22. Canonical page: https://overview.legal/laws/gdpr/art-29 > Every item cites its source. Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it. ## Provision ### Processing under the authority of the controller or processor — Processing under the authority of the controller or processor *GDPR, gdpr-art-29-en — https://overview.legal/laws/gdpr/art-29* The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law. ## Enforcement 32 decision(s) on record cite Article 29, totalling approximately €13,671,826 in fines (median €40,000). Top fines: - **Sky Italia S.r.l.: Insufficient legal basis for data processing** (ITALY, €3,296,326) — https://overview.legal/posts/46992 - **DPD Polska sp. z o.o.: Insufficient data processing agreement** (Poland, €2,682,000) — https://overview.legal/posts/53514 - **DEDALUS BIOLOGIE: Insufficient technical and organisational measures to ensure information security** (FRANCE, €1,500,000) — https://overview.legal/posts/47251 - **MOBIUS SOLUTIONS LTD: Niet-naleving van de algemene principes voor gegevensverwerking.** (FRANCE, €1,000,000) — https://overview.legal/posts/51912 - **MOBIUS SOLUTIONS LTD: Non-compliance with general data processing principles** (FRANCE, €1,000,000) — https://overview.legal/posts/51506 ## Guidance ### Guidelines on processing of personal data through blockchain technologies *EDPB — https://overview.legal/posts/125668* Guidelines 02/2025 on processing of personal data through blockchain technologies Version 2.0 Adopted on 07 July 2026 1 | Adopted Version history Version Date Adoption information version 1.1 08 April 2025 adoption of the guidelines before public consultation version 2.0 07 July 2026 adoption of the guidelines after public consultation 3 | Adopted 4 | Adopted The European Data Protection Board Having regard to Article 70 (1)(e) of the Regulation 2016/679/EU of the European Parliament and of the… ### Template for Cross-Regulatory Cooperation Agreements *EDPB — https://overview.legal/posts/125669* 1 | Adopted Template for Cross-Regulatory Cooperation Agreements Adopted by the EDPB on July 7 th 2026 2 | Adopted Explanatory note Cross-regulatory cooperation between data protection supervisory authorities (DPAs) and other national and EU competent authorities has become increasingly important as legal and practical challenges emerge at the intersection of different regulatory fields. Cooperation agreements can be an important basis to organise and strengthen cooperation and dialogue between… ### Opinion 21/2026 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of the Flutter Group *EDPB — https://overview.legal/posts/125670* Opinion 21/2026 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of the Flutter Group Adopted on 07 July 2026 1 | Adopted 2 | Adopted The European Data Protection Board Having regard to Article 63, Article 64(1)(f) and Article 47 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such… ### Opinion 20/2026 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Fluor Group *EDPB — https://overview.legal/posts/125671* Opinion 20/2026 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Fluor Group Adopted on 07 July 2026 1 | Adopted 2 | Adopted The European Data Protection Board Having regard to Article 63, Article 64(1)(f) and Article 47 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such… ### Opinion 19/2026 on the draft decision of the Dutch Supervisory Authority regarding the Processor Binding Corporate Rules of the Rubrik Group *EDPB — https://overview.legal/posts/125672* Opinion 19/2026 on the draft decision of the Dutch Supervisory Authority regarding the Processor Binding Corporate Rules of the Rubrik Group Adopted on 08 June 2026 1 | Adopted 2 | Adopted The European Data Protection Board Having regard to Article 63, Article 64(1)(f) and Article 47 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such… ## Related topics - **Right of Access** — https://overview.legal/topics/inzagerecht ## Legal Framework - **Processors** — https://overview.legal/topics/processors ## Legal Framework - **Personal Data** — https://overview.legal/topics/persoonsgegevens ## Legal Framework --- Generated by overview.legal · https://overview.legal/laws/gdpr/art-29 · 2026-08-22