§ 37 NDSG
Processing on instruction
(1)Any person acting under the authority of a controller who has access to personal data shall process those data exclusively on the instruction of the controller, unless he or she is required by law to process them.