§ 65 HDSIG
Records of Processing Activities
(1)The controller shall maintain a record of all categories of processing activities under its responsibility. That record shall contain the following information: 1. the name and contact details of the controller and, where applicable, of the joint controller and of the data protection officer, 2. the purposes of the processing, 3. the categories of recipients to whom the personal data have been or will be disclosed, including recipients in third countries or international organisations, 4. a description of the categories of data subjects and the categories of personal data, 5. where applicable, the use of profiling, 6. where applicable, the categories of transfers of personal data to a third country or to an international organisation, 7. information on the legal basis of the processing, including the transfers for which the personal data are intended, 8. where possible, the envisaged time limits for erasure or for a review of the necessity of the storage of the different categories of personal data, and 9. where possible, a general description of the technical and organisational measures pursuant to § 59.
(2)The processor shall maintain a record of all categories of processing carried out on behalf of a controller, which shall contain the following: 1. the name and contact details of the processor, of each controller on whose behalf the processor is acting, and, where applicable, of the data protection officer, 2. the categories of processing carried out on behalf of each controller, 3. where applicable, transfers of personal data to a third country or to an international organisation, where instructed accordingly by the controller, indicating the third country or international organisation concerned, and 4. where possible, a general description of the technical and organisational measures pursuant to § 59.
(3)The records referred to in para. 1 and 2 shall be maintained in writing or in electronic form.
(4)Controllers and processors shall make their records available to the Hessian Data Protection Commissioner upon request. zur Einzelansicht § 65