# Security of processing 32(4) — GDPR — provision context

> Focused context for a single provision (32(4)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-32#par-4
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Security of processing** (GDPR, full article: https://overview.legal/laws/gdpr/art-32).

## Provision text

### 32(4)

The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law.


## Topics on this provision

- **Processors** — https://overview.legal/topics/processors
  Entities that process data on behalf of controllers
- **Right of Access** — https://overview.legal/topics/inzagerecht
  Data subject right to access their personal data
- **Personal Data** — https://overview.legal/topics/persoonsgegevens
  Information relating to identified or identifiable natural persons
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing

## Cited by (exact-provision citations)

- **Judgment of the Court (Third Chamber) of 11 April 2024.#GP v juris GmbH.#Request for a preliminary ruling from the Landgericht Saarbrücken.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 82 – Right to compensation for damage caused by data processing that infringes that regulation – Concept of ‘non-material damage’ – Impact of the seriousness of the damage suffered – Liability of the controlle** (case-law) — https://overview.legal/posts/132262
- **Judgment of the Court (Third Chamber) of 11 April 2024.#GP v juris GmbH.#Request for a preliminary ruling from the Landgericht Saarbrücken.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 82 – Right to compensation for damage caused by data processing that infringes that regulation – Concept of ‘non-material damage’ – Impact of the seriousness of the damage suffered – Liability of the controlle** ¶48 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132262
- **EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro** (guidance) — https://overview.legal/posts/125823
- **Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)** (guidance) — https://overview.legal/posts/38074
- **EDPB Annual Report 2023** (guidance) — https://overview.legal/posts/125756
- **Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria** (guidance) — https://overview.legal/posts/125965
- **Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria** §54 (guidance, EDPB) — https://overview.legal/posts/125965
- **Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria** §57 (guidance, EDPB) — https://overview.legal/posts/125965
- **ANSPDCP (Romania) - AMATO BESTSELLER S.R.L.** (news) — https://overview.legal/posts/291260

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-32#par-4 · 2026-08-22