§ 53 DSG NRW
Records of processing activities
(1)The controller and the processor and, where applicable, their representatives shall maintain a record of their processing activities. Article 30(1) to (4) of Regulation (EU) 2016/679 shall apply accordingly with the proviso that the records pursuant to Article 30(1) of Regulation (EU) 2016/679 shall additionally include information on the legal basis of processing, including transmissions, for which the personal data are intended, and, where applicable, the use of profiling.