§ 28 LDSG SH
Processing on the instruction of the controller
(1)Any person acting under the authority of the controller or of a processor who has access to personal data shall process those data exclusively on the instruction of the controller, unless he or she is required by law to process them. zur Einzelansicht § 28