§ 36 NDSG
Data secrecy
(1)1Persons involved in data processing shall not process personal data without authorisation (data secrecy). 2The obligation of data secrecy shall continue to apply after the termination of their activities. 3The persons shall be informed of the data protection provisions to be observed in their activities.