§ 3 NDSG
Lawfulness of the processing of personal data
(1)1The processing of personal data shall be lawful insofar as it is necessary for the performance of a task within the competence of the controller, the performance of which
(2)is in the public interest or
(3)is carried out in the exercise of official authority vested in the controller,
(4)is necessary. 2The lawfulness of the data processing shall otherwise be determined by Article 6(1) of the General Data Protection Regulation.