§ 37 BlnDSG
Processing on the Instructions of the Controller
(1)Any person subordinate to a controller or a processor who has access to personal data may only process those data on the instructions of the controller, unless they are required by a legal provision to process them.