Processors must ensure that the personal data that they process are kept confidential. Processors are required to keep personal data confidential except on instructions from the controller, unless the processor was required by law to process that data.