KI-generierte Zusammenfassung

This provision requires that any person acting under the authority of the controller or processor who has access to personal data must process those data only on instructions from the controller. The only exception is where Union or Member State law requires otherwise, ensuring a clear chain of command and preventing unauthorised processing by subordinates.