Doing business in Germany means complying with two data protection instruments at once: the EU’s General Data Protection Regulation and Germany’s Federal Data Protection Act, the Bundesdatenschutzgesetz (BDSG). Germany GDPR compliance is stricter than the EU baseline because the BDSG uses the GDPR’s “opening clauses” to tighten the rules on data protection officers, employee data, video surveillance, and criminal liability. The framework applies to any organization with an establishment in Germany, any organization offering goods or services to people in Germany, and any organization monitoring behavior inside the country.
How the BDSG Layers Onto the GDPR
The GDPR applies directly in Germany without needing national transposition. It also deliberately leaves member states room to legislate on specific topics, and Germany used that room extensively when it rewrote the BDSG in 2018.1Gesetze im Internet. Federal Data Protection Act (BDSG)
The BDSG supplements the GDPR rather than replacing it. Where the two rules cover the same ground, the GDPR takes priority unless a valid opening clause authorizes the national rule. In practice, that means you follow the GDPR’s general obligations and then check the BDSG for the German-specific overlays on DPO appointments, employee data, sensitive data, restrictions on data subject rights, automated decision-making in insurance, and credit scoring.
When You Must Appoint a Data Protection Officer
Under the GDPR alone, a Data Protection Officer is mandatory only in limited situations, mainly large-scale monitoring or large-scale processing of sensitive data. Section 38 of the BDSG lowers that threshold significantly. Any company that regularly employs at least 20 people engaged in the automated processing of personal data must appoint a DPO.2Gesetze im Internet. Federal Data Protection Act (BDSG) That catches many mid-sized businesses that would not need a DPO under the GDPR alone.
A DPO is also required, regardless of company size, when the organization carries out processing that requires a Data Protection Impact Assessment, or when it processes personal data commercially for purposes such as market research or credit scoring. The person in the role must have genuine data protection expertise and cannot hold a position that creates a conflict of interest. Heads of IT, HR directors, and senior executives who set data processing purposes are typically disqualified. The DPO monitors compliance internally and acts as the contact point for the supervisory authority and for the individuals whose data is being processed.
Processing Employee Data
Germany has long treated employee privacy as a separate subject, given the power imbalance between employer and worker. Section 26 of the BDSG was designed to govern this area, but the legal ground shifted in March 2023 when the European Court of Justice held in Case C-34/21 that Section 26(1) does not meet the GDPR’s requirements: it largely repeats the GDPR’s own provisions rather than adding the more specific protections Article 88(2) demands from national employment rules.
Processing employee data is not suddenly illegal, but you can no longer treat Section 26 as a standalone legal basis. In practice, employers now rely on the GDPR’s general bases, primarily Article 6(1)(b) for processing necessary to perform the employment contract and Article 6(1)(f) for legitimate interests. A draft Employee Data Protection Act (Beschäftigtendatenschutzgesetz) was meant to close the gap, but that effort collapsed with the governing coalition in late 2024 and the February 2025 elections. Whether the new government revives it is uncertain.
Some practical rules hold regardless of the legal basis. Consent from employees must be genuinely voluntary, and courts scrutinize it heavily because of the employer-employee dynamic. During hiring, collect only information directly relevant to the applicant’s qualifications for the role. Workplace monitoring, whether email scanning, GPS tracking, or keystroke logging, faces steep proportionality requirements that go well beyond what many international companies expect.
Works Councils and Co-Determination
If your company has a works council (Betriebsrat), Section 87(1) No. 6 of the Works Council Constitution Act gives it a mandatory co-determination right whenever the employer introduces or uses technical systems capable of monitoring employee behavior. New HR software, surveillance cameras, and productivity-tracking tools all require works council agreement before rollout. A German court has clarified that works councils do not have a mandatory co-determination right over data protection matters themselves; agreements on data protection structure are voluntary, though works councils retain a general right to information about how employee data is handled.
Video Surveillance
Section 4 of the BDSG governs video surveillance of publicly accessible areas such as shop floors, lobbies, and parking facilities. Cameras are permitted only when necessary for a specifically defined purpose, such as protecting property or preventing physical harm, and only if there is no indication that the interests of the people being filmed outweigh the surveillance interest.2Gesetze im Internet. Federal Data Protection Act (BDSG) The law identifies locations like sports facilities, shopping centers, and public transit as places where protecting life and safety counts as a particularly important interest.
You must post visible signs identifying the surveillance and the controller’s contact details as early as possible, and footage must be deleted without delay once it is no longer needed for the original purpose. In the employment context, courts apply even stricter standards. Covert monitoring of employees is essentially prohibited except where there is a concrete suspicion of criminal activity, less intrusive alternatives have been exhausted, and the monitoring is limited in scope and duration.
Cookies and Tracking Under the TDDDG
Germany implements the EU’s ePrivacy Directive through the Telecommunications Digital Services Data Protection Act (TDDDG). Section 25 requires informed, explicit user consent before any non-essential cookies or tracking technologies are placed on a user’s device. Strictly necessary cookies, such as those needed to run a shopping cart or maintain a login session, are exempt.
Consent standards match the GDPR: pre-checked boxes, scrolling, or continued browsing do not qualify. Users must be told the specific purposes for which consent is sought and must be able to accept or reject each purpose separately. A new ordinance (Einwilligungsverwaltungsverordnung) took effect in April 2025, introducing a framework for “recognized consent management services” that let users store cookie preferences centrally rather than responding to banners on every site. Participation is voluntary for both website operators and users, and consent management providers must undergo annual certification by the BfDI.
International Data Transfers
Sending personal data from Germany to a country outside the European Economic Area triggers Chapter V of the GDPR, which requires that the transfer not undermine the level of protection the regulation guarantees.3General Data Protection Regulation (GDPR). Art. 44 GDPR General Principle for Transfers German supervisory authorities are among the most active in Europe on this issue.
The simplest route is a country the European Commission has recognized as providing adequate protection. That list currently includes Andorra, Argentina, Brazil, Canada (for commercial organizations), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, South Korea, Switzerland, the United Kingdom, the United States (for companies participating in the EU-U.S. Data Privacy Framework), Uruguay, and the European Patent Organisation.4European Commission. Data Protection Adequacy for Non-EU Countries Transfers to adequate countries can proceed without additional safeguards.
For everywhere else, organizations typically use Standard Contractual Clauses approved by the European Commission in June 2021.5European Commission. Standard Contractual Clauses (SCC) Since the Schrems II decision in 2020, you also need to conduct a transfer impact assessment evaluating whether the destination country’s laws might undermine the protections in the clauses. Binding corporate rules, which require supervisory authority approval, are another option mainly used by multinational groups for intra-company transfers.
Individual Rights and Germany’s Restrictions
The GDPR gives individuals rights to access their data, have it corrected, request its deletion, restrict its processing, receive a portable copy, and object to processing based on legitimate interests or direct marketing. There is also a right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.6General Data Protection Regulation (GDPR). Chapter 3 Rights of the Data Subject
Germany uses BDSG opening clauses to restrict several of these rights in defined situations. The right to information and the right of access can be limited when data is processed for purposes other than the original one, or in certain archiving and research contexts. Under Section 35, the right to deletion can be restricted when erasure is technically impossible or disproportionately difficult in automated filing systems, though the controller must then restrict processing of the data instead. Section 37 carves out specific rules for automated decision-making in insurance, permitting it when the applicant’s request is fully granted or when the decision follows binding reimbursement rules, provided the insurer allows human review on request.
Compensation Claims
Article 82 of the GDPR lets anyone who suffers damage from a privacy violation sue the responsible controller or processor.7GDPR-Info.eu. Art. 82 GDPR Right to Compensation and Liability Both financial loss and non-material harm such as emotional distress are covered. Where multiple controllers or processors are involved, each can be held liable for the entire amount of damages.
The German Federal Court of Justice (Bundesgerichtshof) has held that losing control over your personal data can itself count as compensable damage, and that justified fears about data misuse can support a claim. But a bare GDPR violation does not automatically produce a payout. The claimant must show an actual infringement, concrete damage, and a causal link between them. Purely hypothetical risks of misuse, without any demonstrated negative consequence or genuine loss of control, have been rejected. Controllers and processors escape liability if they prove they bear no responsibility for the event that caused the damage.7GDPR-Info.eu. Art. 82 GDPR Right to Compensation and Liability
Who Enforces the Rules
Germany’s federal structure produces an enforcement landscape unlike any other EU member state. Oversight is split between the Federal Commissioner for Data Protection and Freedom of Information (BfDI) in Bonn and 16 state-level authorities (Landesdatenschutzbeauftragte), one per German state.8European Data Protection Board. Guidelines 3/2018 on the Territorial Scope of the GDPR (Article 3)
The BfDI supervises federal agencies and has jurisdiction over telecommunications and postal service providers. The state authorities cover everything else, including private companies and local government agencies within their borders. A private company headquartered in Bavaria answers to Bavaria’s authority; one in Hamburg answers to Hamburg’s. Each state authority operates independently, coordinating through the Conference of Independent Data Protection Supervisory Authorities (DSK) to keep enforcement consistent. For international companies, the lead authority depends on where the main German establishment sits or where primary processing takes place. Priorities and interpretations can vary between states, and companies operating across several states sometimes receive conflicting guidance.
Fines and Criminal Penalties
The GDPR sets a two-tier fine system. The lower tier, covering violations of controller and processor obligations such as failing to keep proper records, skipping a required Data Protection Impact Assessment, or not appointing a DPO when required, can reach €10 million or 2% of total worldwide annual turnover, whichever is higher.9General Data Protection Regulation (GDPR). Art. 83 GDPR General Conditions for Imposing Administrative Fines
The upper tier applies to breaches of the core processing principles, violations of data subject rights, and unauthorized international transfers. Those can reach €20 million or 4% of worldwide annual turnover.9General Data Protection Regulation (GDPR). Art. 83 GDPR General Conditions for Imposing Administrative Fines German authorities have used the upper end. Recent examples include a €45 million fine against Vodafone in 2024 and a €32 million fine against H&M in 2020 for systematic surveillance of employees.
Germany also imposes criminal liability, which sets it apart from most EU countries. Section 42 of the BDSG creates two offenses. The more serious targets anyone who deliberately transfers or makes accessible the personal data of a large number of people for commercial purposes, carrying up to three years in prison. A lesser offense covers unauthorized processing or fraudulent acquisition of personal data done for payment, personal enrichment, or to harm someone, punishable by up to two years.2Gesetze im Internet. Federal Data Protection Act (BDSG) Both offenses are prosecuted only on complaint from the affected individual, the controller, or a supervisory authority. Between administrative fines that can reach a percentage of global turnover and criminal liability that can put individuals in prison, the German framework carries real weight.