§ 50 ThürDSG
Record of processing activities
(1)(Article 24 of Directive (EU) 2016/680)
(2)The controller shall maintain a record of all categories of processing activities under its responsibility. That record shall contain the following information: 1. the name and contact details of the controller and, where applicable, of the joint controller, and the name and contact details of the data protection officer, 2. the purposes of the processing, 3. the categories of recipients to whom the personal data have been or will be disclosed, 4. a description of the categories of data subjects and the categories of personal data, 5. where applicable, the use of profiling, 6. where applicable, the categories of transfers of personal data to bodies in a third country or to an international organisation, 7. information on the legal basis for the processing, 8. the envisaged time limits for erasure or for review of the necessity of storage of the various categories of personal data, and 9. a general description of the technical and organisational measures pursuant to Section 54.
(3)The processor shall maintain a record of all categories of processing activities carried out on behalf of a controller, containing: 1. the name and contact details of the processor, of each controller on whose behalf the processor is acting, and, where applicable, of the data protection officer, 2. where applicable, transfers of personal data to bodies in a third country or to an international organisation, where so instructed by the controller, including the identification of that third country or international organisation, and 3. a general description of the technical and organisational measures pursuant to Section 54.
(4)The records referred to in paragraphs 1 and 2 shall be maintained in writing or in electronic form.
(5)The controller and the processor shall make their records available to the State Commissioner for Data Protection upon request. zur Einzelansicht § 50