§ 28 LDSG SH
Processing on the instruction of the controller
(1)Any person acting under the authority of the controller or of a processor who has access to personal data shall process those data exclusively on the instruction of the controller, unless he or she is required by law to process them.