Data protection & privacy law in Germany (2026)
Data protection in Germany: comprehensive law.
Germany has one of Europe's oldest and most developed data-protection regimes, anchored today in the directly applicable EU GDPR and the national BDSG, which uses GDPR opening clauses to add stricter national rules on employee data, video surveillance, credit scoring, DPO appointments and criminal penalties. Supervision is uniquely decentralised across the BfDI plus 16 Länder authorities coordinating through the Datenschutzkonferenz (DSK); the 2025 coalition agreement (CDU/CSU–SPD) proposes centralising private-sector oversight under a renamed BfDI. Cookies and device-storage tracking are governed by §25 TDDDG (ePrivacy transposition), with a consent-management ordinance that took effect on 1 April 2025.
Legal framework
EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) as directly applicable law, implemented and supplemented nationally by the Bundesdatenschutzgesetz (BDSG, Federal Data Protection Act, in force since 25 May 2018, last amended 2021), with sector-specific rules in the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG, formerly TTDSG). Enforcement is decentralised: the Federal Commissioner for Data Protection and Freedom of Information (BfDI) supervises federal public bodies and telecoms/postal providers, while 16 state (Länder) data protection authorities supervise the private sector and Land bodies.
GDPR & data protection in Germany
In Germany, data protection is governed by the EU General Data Protection Regulation (GDPR), which applies directly and is enforced by the Federal Commissioner for Data Protection (BfDI) and the state (Länder) authorities.
- Framework
- the GDPR (Regulation (EU) 2016/679) plus the national data-protection act
- Supervisory authority
- the Federal Commissioner for Data Protection (BfDI) and the state (Länder) authorities
- Applies to
- any organisation processing the personal data of people in Germany, wherever the organisation is based
- Maximum fine
- €20 million or 4% of global annual turnover, whichever is higher
- Breach notification
- within 72 hours of becoming aware, to the supervisory authority
- DPO
- required for large-scale monitoring or large-scale special-category processing
The GDPR is bloc-wide; Germany supplements it with a national data-protection act and its own supervisory authority.
Key points: data & privacy in Germany
Primary law: GDPR + BDSG
The GDPR applies directly; the BDSG (Bundesdatenschutzgesetz, entered into force 25 May 2018) fills GDPR opening clauses and covers processing outside GDPR scope (e.g. law enforcement under the LED). It includes stricter German rules on employee/HR data (§26), video surveillance (§4), credit scoring (§31) and mandatory DPO appointment thresholds.
Supervisory authorities: BfDI + 16 Länder DPAs
The BfDI supervises federal public bodies, telecoms and postal providers. Each of the 16 federal states runs its own DPA responsible for private-sector and Land-public-sector enforcement; the DSK (Datenschutzkonferenz) coordinates joint positions. Germany is the only EU member state without a single private-sector supervisor.
Cookies & tracking: TDDDG (formerly TTDSG)
The Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz transposes the ePrivacy Directive; §25 TDDDG requires prior, GDPR-standard consent for storing or accessing information on user terminal equipment (cookies, SDKs, pixels) unless strictly necessary. Renamed from TTDSG to TDDDG on 14 May 2024 to align with the EU Digital Services Act.
Consent-management ordinance in force 1 April 2025
Under §26 TDDDG, the Federal Ministry issued an ordinance recognising certified consent-management services (PIMS-like); operational since 1 April 2025 to reduce repetitive cookie banners. Use is voluntary but confers a compliance safe harbour for accepted consent signals.
Data-subject rights and obligations
GDPR rights apply in full (access, rectification, erasure, portability, objection, restriction, automated-decision safeguards). Controllers must maintain records of processing (Art. 30), notify personal-data breaches to the competent DPA within 72 hours (Art. 33), run DPIAs for high-risk processing, and appoint a DPO where at least 20 persons are permanently engaged in automated personal-data processing (§38 BDSG) or where core activities require it under Art. 37 GDPR.
Enforcement: multi-million-euro fines active in 2025
In 2025 the BfDI fined Vodafone GmbH €45 million (€15m for inadequate oversight of partner agencies; €30m for authentication weaknesses in the MeinVodafone portal enabling unauthorised eSIM access). Länder DPAs (notably Bavaria, NRW, Berlin) issued numerous fines against online shops for using Google Analytics, Meta Pixel or Hotjar without TDDDG-compliant consent.
Reform outlook: coalition agreement 2025
The April 2025 CDU/CSU–SPD coalition agreement announces centralising private-sector data-protection supervision under a renamed 'Federal Commissioner for Data Utilisation, Data Protection and Freedom of Information', formally anchoring the DSK in the BDSG with authority to issue binding standards, and easing SME obligations. Legislation is pending, so the fragmented Länder model remains in force today.
GDPR in Germany: FAQ
Does the GDPR apply in Germany?
Yes. As an EU/EEA member, Germany applies the GDPR (Regulation (EU) 2016/679) directly, enforced by the Federal Commissioner for Data Protection (BfDI) and the state (Länder) authorities.
Who enforces data protection law in Germany?
The Federal Commissioner for Data Protection (BfDI) and the state (Länder) authorities.
What are the GDPR fines in Germany?
Up to €20 million or 4% of global annual turnover, whichever is higher.
Do you need a Data Protection Officer in Germany?
A DPO is required where you carry out large-scale monitoring or process special-category data at scale.
How quickly must a data breach be reported in Germany?
Personal-data breaches must be notified to the supervisory authority within 72 hours of becoming aware.
Timeline of decisions
- Enforcement · officialBfDI fines Vodafone €45 million for data-protection failures
Germany's Federal Data Protection Commissioner imposed two fines (€15M for inadequate oversight of partner agencies under Art. 28 GDPR, €30M for weak hotline/portal authentication), among the largest German GDPR penalties to date.
BfDI
- Decision · officialCJEU rules in Meta v. Bundeskartellamt (C-252/21)
The EU Court of Justice upheld the German Federal Cartel Office's power to assess GDPR compliance in abuse-of-dominance cases and curtailed Meta's legal bases for combining and processing user data without freely given consent.
Bundeskartellamt / CJEU
- Law · officialTelecommunications-Telemedia Data Protection Act (TTDSG) enters into force
Germany's new cookie law transposed the ePrivacy Directive, requiring GDPR-grade consent (§25) for storing/accessing information on user devices, resolving years of legal uncertainty over cookie consent.
gesetze-im-internet.de (Federal Ministry of Justice)
- Enforcement · officialHamburg DPA fines H&M €35.3 million for employee surveillance
The Hamburg Commissioner penalized H&M for systematically recording employees' private lives (illnesses, family problems, beliefs) at a service centre, then a record GDPR fine in Germany.
EDPB / Hamburg DPA
- Decision · officialBundeskartellamt prohibits Facebook's unrestricted data combination
The Federal Cartel Office barred Facebook from merging user data across Facebook, Instagram, WhatsApp and third-party sources without voluntary consent, the landmark case linking competition law and data protection that later reached the CJEU.
Bundeskartellamt
- Law · officialNew Federal Data Protection Act (BDSG) takes effect with the GDPR
Germany's overhauled BDSG (via the DSAnpUG-EU adaptation act) entered into force the same day as the EU GDPR, using its opening clauses to tailor rules on employment data, video surveillance and supervisory authorities at national level.
gesetze-im-internet.de (Federal Ministry of Justice)
- LawFederal Data Protection Act revised to implement EU Directive 95/46/EC
The BDSG was amended and republished (the version in force until 2018) to transpose the EU Data Protection Directive, harmonizing German rules with the emerging European framework.
Bundesdatenschutzgesetz overview
- Decision · officialFederal Constitutional Court Census judgment establishes informational self-determination
In the Volkszählungsurteil the Bundesverfassungsgericht struck down parts of the Census Act and recognized a constitutional 'right to informational self-determination', the cornerstone of German and European data-protection law.
Bundesverfassungsgericht
- LawFirst federal Data Protection Act (BDSG) enacted
The Bundestag passed Germany's first national data-protection statute (in force 1 January 1978), regulating processing of personal data by public and private bodies and creating a federal commissioner.
BvD (Federal Association of Data Protection Officers)
- LawHesse enacts the world's first data protection law
The German state of Hesse passed the Hessian Data Protection Act, the first statutory data-protection law anywhere, pioneering the legal concept of regulating automated personal-data processing.
History of Data Protection (G. González Fuster)
Sources
- gesetze-im-internet.de/englisch_bdsg/
- bmi.bund.de/EN/topics/constitution/data-protection/federal-data-protection-act/fe
- bfdi.bund.de/EN/BfDI/UeberUns/DieBehoerde/diebehoerde_node.html
- dlapiperdataprotection.com/countries/germany/authority.html
- bvdnet.de/en/topics/data-policy/tdddg/
- usercentrics.com/knowledge-hub/cookie-flood-control-consent-management-ordinance-tdddg
- cms.law/en/aut/publication/gdpr-enforcement-tracker-report-2025/germany
- cms.law/en/deu/legal-updates/new-developments-in-data-protection-a-look-at-th
- edps.europa.eu/system/files/2025-07/75_iwgdpt_country_report_-_germany_bfdi_en.pdf
- cms.law/en/deu/insight/e-privacy/tracking-according-to-the-eprivacy-directive
- dlapiperdataprotection.com/index.html?t=law&c=DE
- privacymatters.dlapiper.com/2025/04/germany-new-government-plans-to-centralize-data-protection-su
Next for Germany: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 11 Sept 2026. Methodology & how to cite · State of Technology Regulation 2026