Germany Federal Data Protection Act (BDSG)
- ClassificationCategoryData Protection & PrivacyDomainPrivacyFramework FamilyGlobal Privacy Regulations
- Regulatory ContextTypeRegulationLegal InstrumentActSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionEuropeRegion DetailGermanyPublisherGerman Bundestag with the consent of the Bundesrat (enacted); enforced by the BfDI and the supervisory authorities of the Länder
- VersioningVersionBDSG of 30 June 2017 (BGBl. I p. 2097), as last amended by Article 3 of the Act of 3 July 2026 (BGBl. 2026 I No. 199)Effective DateMay 25, 2018 (Article 8(1) of the Act of June 30, 2017)Issue DateJune 30, 2017
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
The Act is federal legislation published free of charge on gesetze-im-internet.de by the Federal Ministry of Justice, with an English translation that lags the German text, and is included with the platform for reference.
Framework text is licensed by its publisher and is included only where stated above.
- The Bundesdatenschutzgesetz (BDSG) of June 30, 2017 adapts German law to the GDPR and transposes the Law Enforcement Directive.
- In force since May 25, 2018, it binds federal public bodies and every private body processing personal data in Germany.
- The BfDI supervises federal bodies and telecommunications companies; the supervisory authorities of the Länder supervise private bodies.
- Part 2 covers special categories, employee data, credit scoring, restrictions on rights, and the 20-person threshold for a data protection officer.
- SmartSuite Privacy Management holds the German choices the BDSG adds to the GDPR, each with an owner, evidence, and a review date.
Overview
The Bundesdatenschutzgesetz (BDSG) is Germany's Federal Data Protection Act of 30 June 2017 (BGBl. I p. 2097), in force since 25 May 2018, which adapts German law to the GDPR, transposes the Law Enforcement Directive (EU) 2016/680 and sets up the Federal Commissioner for Data Protection and Freedom of Information (BfDI). It binds federal public bodies, state public bodies where no state law applies, and every private body processing personal data in Germany or through a German establishment (section 1).
The Bundestag passed the Act with the consent of the Bundesrat as Article 1 of the Data Protection Adaptation and Implementation Act EU; it replaced the BDSG of 1990 and has been amended since, most recently by Article 3 of the Act of 3 July 2026 (BGBl. 2026 I No. 199). The BfDI supervises federal public bodies and telecommunications companies (section 9); the supervisory authorities of the Länder supervise private bodies (section 40).
Organizations apply the BDSG together with the GDPR. Part 2 fills the places where the GDPR leaves choices to member states: special categories of data (section 22), employee data (section 26), research and archiving (sections 27 and 28), credit scoring (section 31), restrictions on data subject rights (sections 32 to 37), the 20-person threshold for a data protection officer (section 38) and sanctions (sections 41 to 43).
Why does it matter?
For a company in Germany the BDSG decides questions the GDPR does not answer: whether it needs a data protection officer, what it may do with employee data, how far access and erasure rights reach when retention duties exist, and which authority will fine it. For federal agencies and police it is the primary rulebook, with Part 3 governing law enforcement processing and Part 4 processing outside both EU instruments.
Key benefits include:
- A low DPO threshold
Section 38 requires private controllers and processors to designate a data protection officer when, as a rule, at least 20 persons are constantly employed in automated processing, and regardless of headcount for DPIA-subject or commercial transfer processing.
- Employee data rules
Section 26 allows processing needed to decide on, perform or end employment, requires documented factual indications before processing to detect crimes, and sets the test for voluntary consent at work.
- National grounds for sensitive data
Section 22 permits special categories of data for social security, health care under professional secrecy, public health and substantial public interest, with the safeguards of section 22(2).
- Rights with German limits
Sections 34 and 35 restrict access and erasure where data are kept only under retention duties or where non-automated erasure is disproportionate, replacing erasure with restriction.
- Two tiers of supervision
The BfDI, a supreme federal authority seated in Bonn (section 8), supervises federal bodies; the Länder authorities supervise private bodies (section 40).
How does it work?
The Act has four Parts. Part 1 (sections 1 to 21) holds common provisions: scope and definitions, processing by public bodies, video surveillance of public spaces (section 4), data protection officers of public bodies (sections 5 to 7), the BfDI (sections 8 to 16), representation in the European Data Protection Board and cooperation between federal and state authorities (sections 17 to 19), and judicial remedies. Part 2 (sections 22 to 44) implements the GDPR. Part 3 (sections 45 to 84) implements Directive (EU) 2016/680 for police and criminal justice processing, and Part 4 (sections 85 and 86) covers activities outside both instruments, such as defense.
A private controller checks section 1(4) for territorial scope, then Part 2: the section 22 grounds and safeguards for special categories, section 24 for processing for other purposes, section 26 for employees, section 31 for scoring and credit information, and sections 32 to 37 for the German restrictions on information, access, erasure, objection and automated decisions. Section 38 settles the DPO question, and the Land supervisory authority of its establishment (section 40) is the regulator. Fines follow GDPR Article 83 through the procedure of section 41, with the Regional Court deciding appeals above 100,000 euros; section 43 adds a fine of up to 50,000 euros for consumer credit information breaches under section 30 and exempts public bodies from fines.
Part 3 gives competent authorities their own regime: principles (section 47), special categories (section 48), consent (section 51), automated decisions (section 54), data subject rights (sections 55 to 61), processor and joint controller duties (sections 62 and 63), security of processing with the BSI technical guidelines taken into account (section 64), breach notification to the BfDI (section 65), data protection impact assessment (section 67), records of processing (section 70), logging (section 76) and third-country transfers (sections 78 to 81). Section 42 makes unauthorized commercial transfer of non-public data of many persons a crime punishable by up to three years.
Key Elements
- Scope (section 1)
Federal public bodies, state public bodies executing federal law without state data protection law, and private bodies processing in Germany, through a German establishment or, without an EU or EEA establishment, within the GDPR's scope; other federal data protection provisions take precedence.
- Federal Commissioner (sections 8 to 16)
A supreme federal authority in Bonn, independent, competent for federal public bodies and telecommunications providers, exercising the GDPR Article 58 powers (section 16).
- Special categories and employment (sections 22 and 26)
National grounds and safeguards for sensitive data; employee data processing limited to what employment requires, with crime detection and consent rules.
- Rights and restrictions (sections 32 to 37)
German limits on the duties to inform and on access, erasure and objection, and the section 37 rule on automated decisions in insurance.
- Data protection officer and supervision (sections 38 and 40)
The 20-person threshold and the DPIA and commercial transfer triggers; Länder authorities for private bodies, with establishment deciding competence.
- Sanctions (sections 41 to 43 and 84)
GDPR fines applied through the Administrative Offences Act, criminal offenses in section 42 (up to three years) and section 84, a 50,000 euro fine for section 30 breaches, no fines against public bodies.
What does it cover?
The BDSG applies to public bodies of the Federation, to public bodies of the Länder where state law does not regulate data protection and they execute federal law, and to private bodies, including processors, that process personal data in Germany, in the context of a German establishment or, without an establishment in the EU or EEA, within the scope of the GDPR (section 1(4)). Part 2 covers GDPR processing, Part 3 covers processing by competent authorities for the prevention, investigation and prosecution of crime, and Part 4 covers activities outside both, including defense. Sixteen state data protection acts govern the Länder's own public bodies.
What are its objectives?
The Act adapts German data protection law to the GDPR and the Law Enforcement Directive and organizes supervision.
Settle the member state choices the GDPR leaves open: special categories, employee data, research, scoring, rights restrictions and the DPO threshold.
Establish the BfDI as an independent supreme federal authority and divide supervision between it and the Länder (sections 8 to 16 and 40).
Implement Directive (EU) 2016/680 for police and criminal justice processing with its own rights, duties and security rules (Part 3).
Apply GDPR fines through German administrative offence procedure and add criminal offences for serious misuse (sections 41 to 43).
Regulate processing outside the EU instruments, such as defense, in Part 4.
Framework in Context
The BDSG sits beneath the directly applicable GDPR and beside sector laws that take precedence over it (section 1(2)), such as the Telecommunications-Digital Services Data Protection Act, and beside the 16 Land data protection acts for state public bodies. It is the German counterpart of Ireland's Data Protection Act 2018 and Austria's DSG, each filling the same GDPR opening clauses in a national way. Its section numbers, the 20-person DPO threshold and the section 26 employee data rule are specific to Germany and have no equivalent in the GDPR text.
Common Framework Mappings
The BDSG fills the GDPR's opening clauses for Germany, so organizations map it to the privacy and security frameworks below to run one program across the GDPR, the Act and their international commitments.
Mapped frameworks include:
APEC PF
ePrivacy Directive (Directive 2002/58/EC)
GDPR
ISO 27001:2022
ISO 27002:2022
ISO 27701
NIST Privacy Framework v1.0
OECD Privacy Guidelines
How SmartSuite Supports Germany BDSG
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Privacy Management to hold the German choices the BDSG adds to the GDPR in one record: the section 38 DPO determination, the section 22 and 26 grounds you rely on for sensitive and employee data, and the section 34 and 35 restrictions you apply to requests, each with an owner, evidence and a review date, with your Land supervisory authority recorded under section 40.
Processing Record with BDSG Basis
Record each processing activity with its GDPR Article 6 or 9 basis and the BDSG section relied on, such as section 22(1), 24 or 26(1), with the section 22(2) safeguards attached.
DPO Determination (section 38)
Document the headcount test, the DPIA and commercial transfer triggers, the designation and the notification to the supervisory authority.
Employee Data Register (section 26)
Flag processing of employee data, record the necessity test, the documented indications for any crime detection processing and the voluntariness assessment for consent.
Request Workflow with German Restrictions
Run access, erasure and objection requests with deadlines, apply the section 34 and 35 restrictions where retention duties exist and document the reasons as section 34(2) requires.
Supervisory Authority File (section 40)
Keep the competent Land authority, correspondence, orders and fine proceedings under section 41 in one case record, with appeal dates.
Law Enforcement Processing (Part 3)
For competent authorities, track section 64 security measures, section 65 breach notifications, section 67 impact assessments, section 70 records and section 76 logging.
Related frameworks
The APEC Privacy Framework (2015) sets nine information privacy principles that APEC economies use to protect personal information while keeping data flowing across the region.
The GDPR (Regulation (EU) 2016/679) sets principles, lawful bases, individual rights and accountability duties for personal data, with fines up to EUR 20 million or 4 percent of turnover.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
ISO/IEC 27002:2022 is the reference set of 93 information security controls in four themes, with attributes and implementation guidance, that supports an ISO/IEC 27001 ISMS.
Frequently Asked Questions For Germany Federal Data Protection Act (BDSG)
Under section 38(1) BDSG, a private controller or processor must designate one when, as a rule, at least 20 persons are constantly employed in the automated processing of personal data. Regardless of headcount, one is required for processing subject to a data protection impact assessment under GDPR Article 35 and for commercial processing for the purpose of transfer, anonymized transfer, or market or opinion research.
Employee data may be processed where necessary to decide on hiring, to perform or end the employment relationship, or to exercise rights and duties under a law or collective agreement. Processing to detect crimes requires documented factual indications of a crime in the employment relationship and a proportionality test, and section 26(2) sets how voluntary consent is judged given the employee's dependence.
The Federal Commissioner for Data Protection and Freedom of Information (BfDI), a supreme federal authority seated in Bonn, supervises federal public bodies and telecommunications providers (sections 8 and 9) and exercises the GDPR Article 58 powers (section 16). The supervisory authorities of the Länder supervise private bodies, with competence following the establishment (section 40).
GDPR Article 83 fines are imposed through the Administrative Offences Act procedure of section 41, with the Regional Court deciding appeals above 100,000 euros. Section 43 adds a fine of up to 50,000 euros for consumer credit information breaches under section 30 and exempts authorities and public bodies from fines. Section 42 makes unauthorized commercial transfer of non-public data of a large number of persons a crime punishable by up to three years.
Yes, in sections 32 to 37. For example, section 34 removes the right of access where data are stored only because retention rules prevent deletion or serve only data security and control and access would take disproportionate effort, and section 35 replaces erasure with restriction of processing where non-automated erasure is impossible or disproportionate and the data subject's interest is minor.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.