The controller and the processor shall keep records of personal...

The controller and the processor shall keep records of personal data processing operations carried out by them, especially when based on legitimate interest.