Directive (EU) 2016/680 Article 23

Processing under the authority of the controller or processor

Article 23

Member States shall provide for the processor and any person acting under the authority of the controller or of the processor, who has access to personal data, not to process those data except on instructions from the controller, unless required to do so by Union or Member State law.

Read the full instrument → · Read this in context: Section 1 — General obligations →

Other provisions in Section 1 — General obligations

Compiled from an official source version. Later amendments or repeals may not be reflected; the official text prevails. · Read the official text ↗ · Data as of 2026-07-04

CitationArticle 23 of Directive (EU) 2016/680 (LawPlayer, data as of 2026-07-04)

What to look at next

Directive (EU) 2016/680, full textChapter navigation and full text, so you can read this section in contextEuropean Union legislation EU Legal Acts by type and yearGrouped by instrument type and year of enactment, so you can find others of the same kindBrowse by type and year Section 1 — General obligations — read this in contextThe surrounding text of the act in order, so you can see what comes before and afterChapters and sections