The Regulation does not define the phrase, but it plainly reaches employees and other staff who have access to personal data within the organisation of the controller or the processor. The criterion in the text is access to personal data combined with acting under the authority of one of the two actors, not the label of the employment or engagement relationship.

Article 28 governs the relationship between controller and processor through a binding contract, while Article 29 states the instruction principle directly as a rule of the Regulation, so a processor acting outside instructions breaches the Regulation itself and not merely the contract. The same principle reappears in Article 32(4), which obliges controller and processor to take steps to ensure that persons under their authority respect it.

Yes, a single one. Processing without or against instructions is permitted where Union or Member State law requires it, mirroring the reservation in point (a) of Article 28(3). Commercial convenience or the processor's own purposes never justify a departure, and a processor pursuing its own purposes becomes a controller under Article 28(10).

The provision itself states the prohibition rather than prescribing the means, but Article 32(4) requires the controller and processor to take steps to ensure compliance by persons under their authority, and point (b) of Article 28(3) requires that persons authorised to process data be committed to confidentiality. Read together, these provisions expect internal measures such as instructions, confidentiality commitments and access controls.