GDPR Art. 29 EN
LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this article. Contains: the article text, related recitals, cases citing it, enforcement stats and top fines, guidance, and related topics. Everything links back to its source on overview.legal — legal information, not advice.

Processing under the authority of the controller or processor

Right of Access Processors Personal Data Controllers
In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗
Version history 2
  • 2016-05-04in force CELEX 02016R0679-20160504
  • 2016-04-27 CELEX 32016R0679

The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law.

Enforcement

Cited in 32 fines totalling €13.7M

Top authority: 🇪🇺Italian Data Protection Authority (Garante) (11) · median fine €40,000 · see all enforcement for Art. 29 →

Related across sources

Case Law NSS - 1 As 183/2023-62 Enforcement AEPD sanctions ACVIL Aparcamientos for denying access to parking surveillance footage Case Law EWCA - Dawson-Damer v Taylor Wessing LLP Case Law Rotterdam Court: DPA did not err in finding ING contactless chip payments GDPR-compliant Case Law SG Nürnberg - S 5 SF 65/24 DS Enforcement HDPA fines DEI for unlawful telemarketing calls to opt-out registered subscribers