CLAIM-2026-08-25-09
GDPR Article 32(4) requires the controller and processor to take steps to ensure that any natural person acting under their authority who has access to personal data does not process them except on instructions from the controller, unless required to do so by Union or Member State law.
Why it matters
The duty that binds today, as opposed to the AI Act duty that binds later.
Sources
- intersoftco2026security