Obligation of the processor to comply with the instructions of the controller
The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law.
Chapter IV, Section 1, Article 29
Regulation's subject matter
Processing under the authority of the controller or processor (Article 29, Section 1, Chapter IV)
Person acting under the authority of the controller or of the processor Processor