The General Data Protection Regulation (GDPR) in its Article 30 legislates on the Records of...

Article 30 in its first paragraph legislates:

1. Each controller and, where applicable, the controller’s representative, shall maintain a record of processing activities under its responsibility.

Recital 82 mentions:

In order to demonstrate compliance with this Regulation, the controller or processor should maintain records of processing activities under its responsibility. Each controller and processor should be obliged to cooperate with the supervisory authority and make those records, on request, available to it, so that it might serve for monitoring those processing operations.