§ 52 BDSG
Processing under the authority of the controller
(1)Any person acting under the authority of the controller or processor who has access to personal data shall only process those data on instruction of the controller, unless he or she is required by a legal provision to carry out the processing.