The provider can only process data as instructed by the company, unless required by law

1.1.The Provider shall only Process Personal Data as a Processor in accordance with the written instructions of the Company as set out in Part I of this DPA, or as otherwise provided to perform the necessary services described in the Existing Agreement (“Permitted Purpose”), unless otherwise required by law, in such case, the Provider shall inform the Company of that legal requirement before Processing.