UK Data Protection Act 2018 s.60: Section 60 Processing under the authority of the controller or processor

What does s.60 require?

A processor and anyone acting under a controller's or processor's authority with access to personal data may process it only on the controller's instructions or to comply with a legal obligation.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Part 3: Law enforcement processing – UK Data Protection Act 2018

s.35 Section 35 The first data protection principle: lawful and fair processing and sensitive processing
s.36 Section 36 The second data protection principle: purpose limitation
s.37 Section 37 The third data protection principle: adequate, relevant and not excessive
s.38 Section 38 The fourth data protection principle: accuracy and distinguishing data
s.39 Section 39 The fifth data protection principle: retention and periodic review
s.40 Section 40 The sixth data protection principle: security
s.40A Section 40A Conditions for consent to law enforcement processing
s.41 Section 41 Safeguards for archiving, research and statistical law enforcement processing

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All UK Data Protection Act 2018 controls