§ 36 NDSG
Data secrecy
(1)Persons involved in data processing shall not process personal data without authorisation (data secrecy). The obligation of data secrecy shall continue to apply after the termination of their activities. The persons shall be informed of the data protection provisions to be observed in their activities.