The controller and the processor shall keep records of personal data processing operations carried out by them, especially when based on legitimate interest.hanges to guarantees presented as sufficient for compliance with the general principles of protection and of the data subject’s rights referred to in item II of Art. 33 of this Law shall be communicated to the national authority.