§ 38 NDSG
Records of processing activities
(1)The controller shall maintain records of processing activities in accordance with Article 30(1) of the General Data Protection Regulation applied mutatis mutandis, additionally including the legal basis of the processing and, where applicable, the use of profiling. Article 30(3) and (4) of the General Data Protection Regulation shall apply mutatis mutandis.