The General Data Protection Regulation (GDPR) in its Article 30 legislates on the Records of treatment activities.
If requested, the controller must provide these records:
Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. Which data processing principle is described here?
