8. Confidentiality

Any person acting under a Data Controller or a Data Processor, including the Data Processor himself, who has access to Personal Data shall not Process them except on instructions from the Data Controller, unless he is required to do so by law.