- Article 5
Principles relating to processing of personal data
- Article 6
Lawfulness of processing
- Article 7
Conditions for consent
- Article 8
Conditions applicable to child’s consent in relation to information society services
- Article 9
Processing of special categories of personal data
- Article 10
Processing of personal data relating to criminal convictions and of fences
- Article 11
Processing which does not require identification
- Section 1
General obligations
- Article 24
Responsibility of the controller
- Article 25
Data protection by design and by default
- Article 26
Joint controllers
- Article 27
Representatives of controllers or processors not established in the United Kingdom
- Article 28
Processor
- Article 29
Processing under the authority of the controller or processor
- Article 30
Records of processing activities
- Article 31
Cooperation with the Commissioner
- Article 24
- Section 2
- Section 3
Data protection impact assessment and prior consultation
- Section 4
Data protection officer
- Section 5
Codes of conduct and certification
- Article 44
General principle for transfers
- Article 45
Transfers on the basis of an adequacy decision
- Article 46
Transfers subject to appropriate safeguards
- Article 47
Binding corporate rules
- Article 48
- Article 49
Derogations for specific situations
- Article 50
International cooperation for the protection of personal data
- Article 77
Right to lodge a complaint with the Commissioner
- Article 78
Right to an effective judicial remedy against the Commissioner
- Article 79
Right to an effective judicial remedy against a controller or processor
- Article 80
Representation of data subjects
- Article 81
- Article 82
Right to compensation and liability
- Article 83
General conditions for imposing administrative fines
- Article 84
Penalties
- Article 85
Processing and freedom of expression and information
- Article 86
Processing and public access to official documents
- Article 86a
Processing and national security and defence
- Article 87
- Article 88
- Article 89
Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
- Article 90
- Article 91
Article 29
Processing under the authority of the controller or processor
The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by domestic law.
Important note about UK GDPR recitals
Recitals to the GDPR are saved into UK domestic law and apply to the interpretation of the UK GDPR. However, they have not been amended upon saving. This may mean that some recitals are no longer relevant if the corresponding provisions have not been retained in UK domestic law. (Tell me more.)