GDPR and German Data Protection Law

German data protection law in brief

German data protection law rests on two layers. The General Data Protection Regulation (GDPR) applies directly and sets the core rules: principles of processing, legal bases, data subject rights, security, international transfers, fines and damages. The Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) uses the opening clauses of the GDPR to add German specifics, such as a lower threshold for appointing a data protection officer, rules on scoring and video surveillance, and procedural rules for fines.

Sector-specific laws add further layers, notably the Telecommunications Digital Services Data Protection Act (TDDDG) for cookies and similar technologies. Together they make German data protection law one of the most actively enforced regimes in Europe.

For companies, the practical challenge is not understanding the GDPR in the abstract but applying it in a German setting: dealing with state supervisory authorities, works councils that co-determine the introduction of monitoring tools, a litigation culture in which individuals claim non-material damages, and courts that review consent banners and privacy notices closely. This page explains the framework, the supervisory set-up, employee data, international transfers, data breaches, fines and damages. For the broader digital framework, see our data and digital law overview.

Supervisory authorities and the DSK

Germany's federal structure is reflected in data protection supervision. The Federal Commissioner for Data Protection and Freedom of Information (BfDI) supervises federal public bodies and certain regulated sectors, such as telecommunications and postal services. Private companies are generally supervised by the data protection authority of the federal state in which they have their main establishment in Germany. The authorities coordinate through the Data Protection Conference (Datenschutzkonferenz, DSK), which issues resolutions, guidance and model procedures. Although DSK papers are not binding law, they reflect how authorities will assess compliance and are widely followed in practice.

For cross-border processing within the EU, the GDPR's one-stop-shop mechanism applies: the authority of the controller's main establishment in the EU acts as lead supervisory authority and cooperates with the other concerned authorities through the European Data Protection Board (EDPB). Groups with their EU headquarters in Germany therefore deal mainly with one German state authority, but may face enquiries from other authorities on local matters. Groups headquartered elsewhere in the EU may still be approached by German authorities on processing that substantially affects people in Germany.

Key obligations under German data protection law

The core obligations are the same as elsewhere in the EU, but German authorities and courts have developed a demanding practice. Every processing operation needs a legal basis under Article 6 GDPR, and special categories of data such as health data need an additional exception under Article 9. Controllers must keep a record of processing activities, inform data subjects transparently, conclude data processing agreements with processors (Article 28 GDPR), implement appropriate technical and organisational security measures and carry out data protection impact assessments for high-risk processing. German supervisory authorities publish lists of processing operations that require an impact assessment, and they expect these to be documented.

The data protection officer is a particularly German feature. In addition to the GDPR cases, § 38(1) BDSG requires a DPO where a controller or processor usually employs at least 20 persons constantly engaged in the automated processing of personal data. The DPO can be an employee or an external service provider, must be involved in all data protection issues and enjoys protection against dismissal when appointed as a mandatory internal DPO. Our insight on data protection officers in Germany explains the role.

Cookies, tracking and online services

The storage of information on, or access to information in, a user's device requires the user's consent based on clear and comprehensive information (§ 25(1) TDDDG), unless an exception applies, for example where access is strictly necessary to provide a service the user has expressly requested. Consent must meet GDPR standards. German authorities and courts have repeatedly criticised banners that make refusal harder than acceptance. Subsequent processing of the data collected, for analytics or advertising, needs its own legal basis under the GDPR. See our insight on cookie consent under the TDDDG.

Scoring and automated decisions

Credit scoring and other automated assessments are a focus of German enforcement. In SCHUFA (CJEU, judgment of 7 December 2023, C-634/21), the CJEU held that the automated calculation of a probability value by a credit agency is itself an automated individual decision under Article 22 GDPR where a third party draws strongly on it in deciding whether to enter into a contract.

Such decisions are only permitted under one of the exceptions in Article 22(2) GDPR and require safeguards such as the right to obtain human intervention. Whether § 31 BDSG, the German rule on scoring, provides a valid legal basis was left to the national courts. Companies using scores from credit agencies or their own algorithms in contracting decisions should review their processes accordingly; see our insight on the SCHUFA judgment.

Access requests as a litigation tool

The right of access under Article 15 GDPR, including the right to a copy of the personal data, is increasingly used in Germany as an informal discovery tool, for example by employees in dismissal disputes or by customers in contractual disputes. Requests must generally be answered within one month. Companies should have a process to locate data across systems, assess exemptions and protect third-party data and trade secrets, and they should coordinate responses with any pending litigation.

Employee data after the CJEU's case law

Employee data protection is one of the most litigated areas of German data protection law. § 26(1) BDSG permits processing of employees' data where necessary for the establishment, performance or termination of the employment relationship. In its judgment in Hauptpersonalrat der Lehrerinnen und Lehrer (CJEU, judgment of 30 March 2023, C-34/21), the CJEU held that national rules on employee data adopted under Article 88 GDPR must contain specific measures to safeguard employees' rights and cannot merely repeat the GDPR.

The general clause in § 26(1) BDSG is widely regarded as not meeting that standard, so employers now rely directly on Article 6(1) GDPR, in particular the performance of the employment contract, legal obligations and legitimate interests.

Works agreements (Betriebsvereinbarungen) remain an important instrument. They can regulate HR systems in detail, but they must comply with the GDPR's principles and cannot lower its protection.

The introduction of technical systems capable of monitoring employees' performance or behaviour requires the works council's agreement (§ 87(1) no. 6 of the Works Constitution Act, BetrVG), which covers most modern HR, collaboration and AI tools. Consent from employees is valid only in limited cases because of the imbalance of power. A dedicated employee data protection act has been discussed for years but has not been enacted. See our insights on employee data protection after the CJEU and the CJEU's ruling in C-34/21.

International transfers and data breaches

Transfers of personal data outside the EEA require a transfer mechanism under Chapter V GDPR. For the United States, the Commission adopted an adequacy decision for the EU-US Data Privacy Framework on 10 July 2023, which covers transfers to certified US organisations. The General Court dismissed an action for annulment of that decision on 3 September 2025 (General Court, judgment of 3 September 2025, Latombe v Commission, T-553/23).

Transfers to non-certified recipients and to most other third countries require standard contractual clauses and a transfer impact assessment. Prudent companies keep their SCCs in place as a fallback in case the adequacy decision is challenged again. See our insight on international data transfers.

A personal data breach must be notified to the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to individuals (Article 33 GDPR). Where the risk is high, the data subjects must also be informed (Article 34 GDPR).

Every breach must be documented internally, whether or not it is notified. In a cyber attack, breach notification under the GDPR runs in parallel with incident reporting under the BSI Act for entities covered by NIS2, which requires an early warning within 24 hours. Incident response plans should integrate both timelines and the communication with insurers, customers and law enforcement.

Fines and damages under German data protection law

Supervisory authorities can impose fines of up to EUR 20 million or 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher, for infringements of the principles, legal bases, data subject rights and transfer rules, and up to EUR 10 million or 2% for other infringements (Article 83(4), (5) GDPR).

In Deutsche Wohnen (CJEU, judgment of 5 December 2023, C-807/21), the CJEU held that a fine can be imposed on a legal person without first establishing the infringement by an identified natural person, but only where the infringement was committed intentionally or negligently. The maximum is calculated on the turnover of the undertaking as an economic unit, typically the group.

German procedure follows the Administrative Offences Act, and objections against fines above EUR 100,000 are heard by the regional court (§ 41(1) BDSG). See our insight on GDPR fines in Germany.

Damages claims under Article 82 GDPR have become a mass phenomenon in Germany. The CJEU has held that non-material damage need not reach a threshold of seriousness, but the claimant must prove an infringement, damage and causation. In the Facebook scraping case, the Federal Court of Justice (BGH) held that mere loss of control over personal data can constitute non-material damage, without further negative consequences, and saw no objection to a figure of around EUR 100 in such a case (BGH, judgment of 18 November 2024 – VI ZR 10/24).

Individually small amounts multiply in mass claims, which can be bundled by claim vehicles or pursued as consumer redress actions. Our insight on GDPR damages claims in German courts analyses the case law.

Competitors and consumer associations can also enforce data protection rules. The CJEU has confirmed that national law may allow competitors to sue over GDPR breaches as unfair commercial practices, and German consumer associations have standing to bring actions for injunctions. Data protection compliance is therefore not only a regulatory issue but also a litigation risk from several directions.

Building a German data protection compliance programme

A sound programme combines governance, documentation and practical controls. Typical elements are:

• a record of processing activities that reflects actual systems and data flows, maintained with IT and business owners;
• a privacy notice set that matches the record and the cookie set-up;
• data processing agreements with all processors, and transfer mechanisms with all third-country recipients;
• works agreements for HR systems, negotiated with data protection requirements in mind;
• a breach response plan with clear roles and pre-agreed external support;
• a process for data subject requests, which German claimants increasingly use as a discovery tool in employment and commercial disputes;
• training, audits and reporting to management.

Under German data protection law, documentation is not a formality: authorities typically start an investigation by requesting the record of processing, the relevant impact assessment and the contracts with processors, and gaps in these documents often lead to findings even where the processing itself is defensible. Upcoming changes should be monitored without delaying current compliance. The Commission's Digital Omnibus proposal of November 2025 would amend the GDPR and the cookie rules, but was still being negotiated according to the latest Council document we reviewed (1 June 2026).

German data protection law also interacts with other regimes: the Data Act for product data, the AI Act for automated systems and the BSI Act for security incidents. Aligning these obligations avoids conflicting policies.

How TRW & Co helps

We advise companies on German data protection law across the full life cycle: building and auditing compliance programmes, drafting privacy notices, data processing and transfer agreements, negotiating works agreements on HR and AI systems, and supporting data protection officers. When incidents occur, we manage breach response and notifications. We represent clients before the German supervisory authorities, defend fine proceedings, and act in damages claims, collective actions and data access disputes. We also review data protection in transactions. To discuss a data protection matter, please contact us. This page is general information and not legal advice.