A controller instructs its processor to keep processing in a way the processor reasonably believes infringes the GDPR. What should the processor do?
Select an answer to reveal the explanation.
Short Explanation
If the boss tells the warehouse to ship something illegal, a good warehouse doesn't just shrug and load the truck—they flag it. Processors should tell the controller when an instruction looks like a GDPR breach.
Full Explanation
If a controller instructs its processor to keep processing in a way the processor reasonably believes infringes the GDPR, the processor should inform the controller that the instruction appears to infringe rather than follow it blindly. That notification duty interrupts unlawful outsourcing chains so residents’ and customers’ data are not processed under knowingly non-compliant orders. Always executing the instruction silently to preserve the commercial relationship fails by elevating revenue over legality and increasing exposure for both parties. Immediately fining the controller under Article 83 without involving any authority fails because processors do not administer administrative fines. Publishing the personal data publicly as a protest against the instruction fails catastrophically—further unlawful disclosure is not a lawful remedy. Exam caveat: processors must not process except on documented instructions, yet they also must not treat clearly infringing instructions as ordinary work; notice to the controller is the mandated first response, not freelancing a new purpose. Operational check: train service desks on unlawful-instruction escalation, embed contractual notice procedures, pause the disputed activity pending clarification, involve legal/DPO review, and retain dated notice records.