Processing

The organization must provide a mechanism for individuals to object to the processing of their data, documenting the legal and regulatory requirements relating to objection such as objection to direct marketing, informing individuals of their ability to object...

The processor, and any person acting under the authority of the controller or of the processor who has access to personal data, must not process that data except on instructions from the controller, unless required to do so by Union or Member State law.

Principles of lawfulness, good faith, proportionality, purpose limitation, and accuracy

Definitions for law enforcement processing. Article 26 sets the definitions applicable to Title 2 (law-enforcement processing), including personal data, processing, competent authority and related terms.

Personal data may be processed for archiving in the public interest, including in the National Archives system, subject to safeguards under the Archives Act and appropriate technical and organisational measures.

Where the operator entrusts personal data processing to another person, this must be done on the basis of an agreement that contains the list of operations, processing purposes, confidentiality and protection obligations, and the requirement to act on the oper...