Data Protection, IT and Digital Law in Germany

Data and digital law in Germany: an overview

Data and digital law has become one of the densest areas of regulation for companies operating in Germany. The General Data Protection Regulation (GDPR) and the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) govern personal data. The EU Data Act governs access to and sharing of data generated by connected products and cloud switching. The AI Act regulates artificial intelligence by risk category. Germany's implementation of the NIS2 Directive in the new BSI Act imposes cybersecurity obligations on a large number of companies, and the Cyber Resilience Act adds security requirements for products with digital elements.

Online platforms face the Digital Services Act and, for the largest players, the Digital Markets Act and § 19a of the German Act against Restraints of Competition (GWB).

Most of these instruments are EU regulations that apply directly, but each relies on German implementing acts that designate authorities, set fines and fill gaps. In 2025 and 2026 Germany adopted several of these acts: the BSI Act implementing NIS2 entered into force on 6 December 2025, the Data Act implementation act (DADG) on 30 May 2026 and the AI market surveillance act (KI-MIG) on 29 July 2026. The Federal Network Agency (Bundesnetzagentur) has become a central digital regulator alongside the data protection authorities, the Federal Office for Information Security (BSI) and the Federal Cartel Office (Bundeskartellamt).

GDPR and German data protection law

The GDPR remains the foundation of data and digital law. In Germany, it is supplemented by the BDSG and by sector-specific rules, such as the Telecommunications Digital Services Data Protection Act (TDDDG) for cookies and similar technologies. Supervision is decentralised: the Federal Commissioner for Data Protection and Freedom of Information (BfDI) supervises federal bodies and certain sectors, while the state data protection authorities supervise private companies based in their state. The authorities coordinate in the Data Protection Conference (DSK), whose guidance shapes enforcement practice.

German law requires a data protection officer where a controller or processor usually employs at least 20 persons constantly engaged in the automated processing of personal data (§ 38(1) BDSG), a stricter rule than the GDPR itself.

Fines can reach EUR 20 million or 4% of worldwide annual turnover for the most serious infringements (Article 83(5) GDPR). The CJEU confirmed in Deutsche Wohnen (C-807/21) that fines can be imposed on a company without identifying a specific manager, but require intentional or negligent conduct. Employee data, international transfers, data breaches and damages claims under Article 82 GDPR are the main pressure points; our page on GDPR and German data protection law covers each in detail.

Employee data deserves particular attention. Following the CJEU's judgment in Hauptpersonalrat der Lehrerinnen und Lehrer (C-34/21), the general clause on employee data in § 26(1) BDSG is widely regarded as no longer a self-standing legal basis, and employers rely on Article 6 GDPR and on works agreements with real safeguards. Monitoring tools also trigger works council co-determination. See our insight on employee data protection after the CJEU.

International data transfers remain a structural issue for groups with US or Asian parents and service providers. Transfers to US recipients certified under the EU-US Data Privacy Framework can rely on the Commission's adequacy decision; transfers to other third-country recipients require standard contractual clauses and a transfer impact assessment. Remote access from a third country, for example by a support team, counts as a transfer.

Data breaches must be notified to the supervisory authority within 72 hours of becoming aware of them where they pose a risk to individuals (Article 33 GDPR), and the same incident may trigger NIS2 reporting to the BSI on a 24-hour timetable. See our insight on international data transfers.

Damages claims are a growing risk. German courts have dealt with a large volume of claims for non-material damage under Article 82 GDPR, and the Federal Court of Justice held that mere loss of control over personal data can constitute damage. Individually small amounts become significant when multiplied across a customer base, especially where claims are bundled or brought as collective actions.

The Data Act and data sharing

The Data Act (Regulation (EU) 2023/2854) has applied since 12 September 2025. It gives users of connected products and related services a right to access the data generated by their use and to have it shared with third parties, sets rules against unfair terms in data-sharing contracts between businesses, and requires providers of cloud and other data processing services to facilitate switching.

Products and related services placed on the market after 12 September 2026 must be designed so that the data are accessible to the user by default (Article 3(1) and Article 50 of the Data Act). From 12 January 2027, cloud providers may no longer charge switching fees (Article 29).

Germany designated the Federal Network Agency as the competent authority in the Data Act Application and Enforcement Act (DADG), in force since 30 May 2026, with the BfDI responsible for the data protection aspects in relation to private bodies (§§ 2 and 3 DADG). Manufacturers of machines, vehicles, household appliances and industrial equipment are most directly affected, but every company that licenses product data, uses cloud services or negotiates data clauses with suppliers needs to review its contracts. Our Data Act compliance page sets out the obligations, the protection of trade secrets and the practical steps for manufacturers and cloud customers.

Data-sharing contracts are a second focus. Chapter IV of the Data Act makes certain contractual terms on data access and use unfair, and therefore not binding, where they have been unilaterally imposed on another enterprise. It applies to contracts concluded after 12 September 2025 and, from 12 September 2027, also to certain older long-term contracts. Companies should update their standard terms for data licensing, maintenance and supply contracts accordingly.

The AI Act in Germany

The AI Act (Regulation (EU) 2024/1689) regulates AI systems according to risk. Prohibited practices and the AI literacy rules have applied since 2 February 2025, and obligations for providers of general-purpose AI models since 2 August 2025. The Digital Omnibus on AI, Regulation (EU) 2026/1744, published on 24 July 2026, postponed the rules for high-risk AI systems: they now apply from 2 December 2027 for systems listed in Annex III and from 2 August 2028 for AI in products covered by Annex I.

The omnibus also reworded the AI literacy duty in Article 4 so that providers and deployers must take measures to support the AI literacy of their staff, without having to guarantee a specific level, and added new prohibitions on AI systems generating non-consensual intimate imagery, applying from 2 December 2026.

In Germany, the KI-MIG, in force since 29 July 2026, makes the Federal Network Agency the principal market surveillance authority for the AI Act, with BaFin responsible for AI systems directly connected with regulated financial activities and product-safety authorities covering AI in regulated products (§ 2 KI-MIG).

Transparency obligations, for example on informing people that they are interacting with an AI system and on marking AI-generated content, have applied since 2 August 2026, with a short transitional period for the marking of content generated by systems already on the market. Employers must also consider works council rights when introducing AI tools, because systems capable of monitoring employees are subject to co-determination. Our page on EU AI Act compliance in Germany explains the classification, obligations and timetable, and how companies can build an inventory of the AI systems they develop, buy or use.

Cybersecurity: NIS2, the BSI Act and the CRA

Germany implemented the NIS2 Directive through a new BSI Act (BSIG), in force since 6 December 2025. It distinguishes between particularly important and important entities, based on sector, headcount and financial thresholds (§ 28 BSIG). Entities in sectors listed in the Act's annexes with at least 50 employees, or with annual turnover and balance sheet total each above EUR 10 million, are generally important entities; larger entities and operators of critical facilities are particularly important.

They must register with the BSI within three months (§ 33 BSIG), implement risk-management measures (§ 30), report significant incidents within 24 hours, 72 hours and one month (§ 32), and their management must implement and supervise those measures and attend regular training (§ 38).

Fines reach EUR 10 million for particularly important entities and EUR 7 million for important entities, and for particularly important entities with turnover above EUR 500 million up to 2% of total turnover (§ 65 BSIG). Alongside NIS2, the Cyber Resilience Act (Regulation (EU) 2024/2847) introduces security requirements for products with digital elements, with reporting obligations from 11 September 2026 and full application from 11 December 2027. Our page on cybersecurity under NIS2, the BSIG and the CRA covers both regimes and management liability.

Digital platforms, DSA, DMA and IT contracts

The Digital Services Act (Regulation (EU) 2022/2065) has applied to all intermediary services since 17 February 2024. It imposes layered duties on hosting services, online platforms and marketplaces, including notice-and-action, transparency, trader traceability and a ban on manipulative interface design, with the heaviest obligations for very large online platforms and search engines. In Germany, the DSA is enforced under the Digital Services Act (Digitale-Dienste-Gesetz, DDG), which designates the Federal Network Agency as the competent authority, with specific roles for youth protection authorities (§ 12 DDG). Fines under national enforcement can reach 6% of annual worldwide turnover (Article 52(3) DSA).

Gatekeepers are regulated by the Digital Markets Act at EU level and, in Germany, by § 19a GWB, which allows the Bundeskartellamt to designate undertakings of paramount significance for competition across markets and to prohibit specific practices. For most businesses, the practical side of digital law lies in IT contracts: software development, SaaS and cloud agreements, IT outsourcing and data processing agreements. Our page on digital platforms, the DSA and DMA covers platform regulation and IT contracting, and our insight on SaaS and cloud contracts explains German standard-terms control.

What is still changing in data and digital law

Data and digital law will continue to evolve in 2027. The European Commission's broader Digital Omnibus proposal of November 2025 (interinstitutional file 2025/0360(COD)) would amend the GDPR, the ePrivacy rules on cookies, the Data Act and the NIS2 Directive; according to the latest Council document we reviewed, dated 1 June 2026, it was still under negotiation. The Commission is also preparing guidelines and standards under the AI Act, and Germany is working on further digital legislation, including rules on digital violence. Companies should track these files, but should not delay compliance with rules already in force in the hope of later relief.

Case law is a further driver of change. The CJEU continues to interpret core GDPR concepts, from automated decision-making in SCHUFA (C-634/21) to the role of competition authorities in Meta Platforms v Bundeskartellamt (C-252/21), and German courts are developing the law on damages, employee data and cookie consent. Several of these decisions changed established practice overnight. A periodic legal update, linked to the compliance register, helps keep policies and contracts current without constant ad hoc reviews.

For international groups, a recurring question is how far German rules go beyond the EU baseline. The answer differs by area: the BDSG adds the 20-person DPO threshold and specific rules on scoring and video surveillance; the BSI Act adds German specifics on critical facilities; the DDG and DADG mainly organise enforcement. A short gap analysis against the German implementing acts usually reveals the points that a group-wide EU programme has missed. Our insight on a legal roadmap for digital transformation shows how to structure the work.

Governance: who owns digital compliance?

The sheer number of overlapping regimes makes governance the decisive success factor. In many German companies, the data protection officer, the information security officer, product compliance, procurement and the legal department each own one piece of data and digital law, but nobody owns the whole. Management bodies are increasingly exposed: the BSI Act requires management to implement and supervise cybersecurity measures and attend training, and general corporate law duties of care extend to compliance organisation. A practical model is a digital compliance committee that meets regularly, maintains one register of obligations and deadlines, and reports to the management board.

Illustration: a hypothetical German manufacturer of connected heating systems sells through installers and runs a cloud platform for remote maintenance. Its compliance map shows that new models need Data Act access by design, the cloud platform needs Data Act switching terms, product software must meet Cyber Resilience Act requirements by December 2027, user data falls under the GDPR, and the company may itself be an important entity under the BSI Act because of its size and sector. One programme with a shared timeline avoids five separate projects.

How TRW & Co helps

We advise companies on data and digital law in Germany, from GDPR compliance programmes and data breach response to Data Act implementation, AI governance, NIS2 registration and risk management, and platform regulation.

We draft and negotiate IT, SaaS, cloud, outsourcing and data-sharing agreements, represent clients before data protection authorities, the BSI and the Federal Network Agency, and defend fines and damages claims. We also work with works councils on the introduction of digital tools, prepare boards for their oversight duties under NIS2, and review data and digital law issues in M&A due diligence and carve-outs, where data assets, IT contracts and compliance gaps often affect value. To discuss your digital compliance programme, please contact us. This page provides general information, not legal advice.