§ 38 NDSG
Records of processing activities
(1)1The controller shall maintain records of processing activities in accordance with Article 30(1) of the General Data Protection Regulation applied mutatis mutandis, additionally including the legal basis of the processing and, where applicable, the use of profiling. 2Article 30(3) and (4) of the General Data Protection Regulation shall apply mutatis mutandis.