§ 55 DSG NRW
Logging
(1)In automated processing systems, controllers and processors shall log at least the following processing operations:
(2)1. collection,
(3)2. alteration,
(4)3. consultation,
(5)4. disclosure including transmission,
(6)5. combination, and
(7)6. erasure.
(8)The logs of consultations and disclosures must make it possible to establish the justification, the date and time of these operations and, as far as possible, the identity of the person who consulted or disclosed the personal data and the identity of the recipient of the data.
(9)The logs may be used exclusively for verification of the lawfulness of data processing by the official data protection officer, the State Commissioner for Data Protection and Freedom of Information and the data subject, as well as for self-monitoring, for ensuring the integrity and security of the personal data and for criminal proceedings.
(10)The log data shall be erased at the end of the year following the year in which they were generated.
(11)The controller and the processor shall make the logs available to the State Commissioner for Data Protection and Freedom of Information upon request.