Germany. Comprehensive data protection. Act
BDSGFederal Data Protection Act (Bundesdatenschutzgesetz – BDSG)
Partly verified
Medium confidence.Länder DPAs (e.g. BayLDA, LfDI BW, HmbBfDI, BlnBDI) are the competent authorities for most companies; coordinated via the Datenschutzkonferenz (DSK). A BDSG reform bill lapsed with the 2025 federal election.
§1Summary
- Synopsis
The BDSG supplements the GDPR for federal bodies and the private sector, transposes the Law Enforcement Directive and contains significant national derogations. Private companies are supervised by the DPA of the Land where they are established.
- Key themes
- Unique features
Age of digital consent (GDPR Art 8): 16. DPO mandatory where at least 20 persons regularly process personal data automatically (§38); employee data rule §26 (validity of §26(1) questioned by CJEU C-34/21); credit scoring §31 (affected by CJEU C-634/21 SCHUFA); criminal offences §42; no fines on public bodies §43.
- SaaS relevance
Applies alongside the GDPR to any SaaS provider established in, or targeting users in, this country; national rules on age of consent, employee data and offences shape onboarding and HR-related features.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Authority 72h; individuals without undue delay (GDPR Arts 33-34)
- DPO
- Yes
- Cross-border transfers
- GDPR Chapter V (adequacy/SCCs/BCRs)
- Maximum penalty
- GDPR Art 83: €20m or 4% global turnover; criminal penalties up to 3 years' imprisonment (§42)
§3Dates
- Key dates
- Adopted
- In force
- Enacted as Art 1 of DSAnpUG-EU (BGBl. I 2017 p. 2097); amended 2019 (2nd DSAnpUG-EU)
§4Text and authority
- Text
- Authoritative text gesetze-im-internet.de
- English text gesetze-im-internet.de
- Authority
- Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) for federal public bodies/telecom; 16 Länder DPAs for the private sector
§5Where it applies
- Domestic law of
- Germany
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Länder DPAs (e.g. BayLDA, LfDI BW, HmbBfDI, BlnBDI) are the competent authorities for most companies; coordinated via the Datenschutzkonferenz (DSK). A BDSG reform bill lapsed with the 2025 federal election.