Germany
Full entry AI-checked Checked 5 November 2026
Read this together with European Union, which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Bundesdatenschutzgesetz (BDSG) | BDSG of 30 June 2017 (BGBl. I S. 2097), as amended | In force | 25 May 2018 |
| Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG) | TDDDG of 23 June 2021 (BGBl. I S. 1982), as amended | In force | 1 December 2021 |
| Gesetz gegen den unlauteren Wettbewerb (UWG) | UWG as published on 3 March 2010 (BGBl. I S. 254), as amended | In force | 8 July 2004 |
| KI-Marktüberwachungs-und-Innovationsförderungs-Gesetz (KI-MIG) | KI-MIG of 22 July 2026 (BGBl. 2026 I Nr. 223) | In force | 29 July 2026 |
| Gesetz zur Umsetzung der Richtlinie (EU) 2023/2225 über Verbraucherkreditverträge und zur Regelung der Förderung klimaneutraler Mobilität | BGBl. 2026 I Nr. 139 (12 May 2026), Article 3 amends the BDSG | Enacted, not yet in force | 20 November 2026 |
| Bill to amend the BDSG (Bundesrat initiative) | BT-Drucksache 21/7732 (26 August 2026) | Draft, not law | — |
- Bundesdatenschutzgesetz (BDSG): The main national law read with the GDPR. In December 2025 the federal and state governments agreed to reform data protection supervision by 31 December 2027, and the governing coalition wants to simplify and bundle it, including by giving the BfDI more of it. None of this is law yet.
- Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG): Cookies and similar technologies (§ 25). Called the TTDSG until 14 May 2024. The Einwilligungsverwaltungsverordnung (EinwV) on recognised consent management services has applied since 1 April 2025.
- Gesetz gegen den unlauteren Wettbewerb (UWG): Unfair competition law. § 7 covers unsolicited advertising by phone, email, fax and automated calls.
- KI-Marktüberwachungs-und-Innovationsförderungs-Gesetz (KI-MIG): Germany’s law for carrying out the EU AI Act. It names the national authorities, sets up an independent AI market surveillance chamber at the Bundesnetzagentur, and covers fines.
- Gesetz zur Umsetzung der Richtlinie (EU) 2023/2225 über Verbraucherkreditverträge und zur Regelung der Förderung klimaneutraler Mobilität: From 20 November 2026 it replaces the BDSG’s scoring rule (§ 31) with a new § 37a, and adds duties for credit databases and credit checks to § 30.
- Bill to amend the BDSG (Bundesrat initiative): Would put the Datenschutzkonferenz (DSK) on a legal footing and let company groups and research projects ask for one lead state authority. The federal government has said it will present its own reform.
Regulators
Section titled “Regulators”- Federal Commissioner for Data Protection and Freedom of Information (BfDI), for federal public bodies and telecom and postal providers
- State data protection authorities (one per state, two in Bavaria), for most businesses, coordinated in the Datenschutzkonferenz (DSK)
- Church data protection supervisors (Catholic dioceses and Protestant churches), for the churches and many church bodies instead of the state authorities
- Bundesnetzagentur, the main AI Act market surveillance authority, which also fines unlawful phone advertising
What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”The GDPR applies directly, and the BDSG adds national rules. For businesses the BDSG applies when they process data in Germany, act through a German establishment, or fall under the GDPR from outside the EU and EEA. Most businesses are supervised by the authority of the state they’re based in. The BfDI covers federal bodies and telecom and postal providers. State public bodies mostly follow their own state’s data protection act. The Catholic and Protestant churches, and many church bodies, follow their own laws (KDG, DSG-EKD) and supervisors (Art. 91 GDPR).
Sources: gesetze-im-internet.de/bdsg_2018/__1.html · gesetze-im-internet.de/bdsg_2018/__40.html · gesetze-im-internet.de/bdsg_2018/__9.html · bfdi.bund.de/DE/Buerger/Privatwirtschaft/Privatwirtschaft_node.html · bfdi.bund.de/DE/Service/Anschriften/Kirchen/Kirchen-node.html · eur-lex.europa.eu/legal-content/EN/TXT/HTML
Lawful bases
Section titled “Lawful bases”The GDPR’s six lawful bases apply. The BDSG adds national grounds, such as § 22 for special category data and § 24 for businesses reusing data to avert security threats, prosecute crimes or pursue legal claims. § 26 covers employee data, but since the CJEU’s 2023 ruling on a similar Hesse rule (C-34/21) the BfDI calls it too vague, and national rules that fail Art. 88 GDPR must be disregarded. So check the GDPR basis directly. No separate employee data law has been adopted.
Sources: gesetze-im-internet.de/bdsg_2018/__22.html · gesetze-im-internet.de/bdsg_2018/__24.html · gesetze-im-internet.de/bdsg_2018/__26.html · bfdi.bund.de/DE/Buerger/Basiswissen/Beschaeftigte/Beschaeftigte_node.… · datenschutzkonferenz-online.de/media/en/2023-05-11_DSK-Entschliessung… · eur-lex.europa.eu/legal-content/EN/TXT
Leads, not sources: riehnlegal.blog/content/artikel
Consent age for online services
Section titled “Consent age for online services”Germany kept the GDPR default. When an online service offered directly to a child relies on consent, children can consent for themselves from 16. Below that, a parent must give or authorise consent. German law sets no lower age.
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · bundestag.de/resource/blob/959324/WD-10-019-23-pdf.pdf
Children
Section titled “Children”The GDPR’s child rules apply, such as weighing children’s interests with particular care and explaining things in plain language. Youth media protection law (the federal JuSchG and the states’ JMStV) applies alongside. From 20 November 2026, scores under the new § 37a BDSG may not be made or used about minors.
Sources: bundestag.de/resource/blob/959324/WD-10-019-23-pdf.pdf · recht.bund.de/bgbl/1/2026/139/VO.html
Cookies and similar technologies
Section titled “Cookies and similar technologies”Storing or reading information on a user’s device needs consent based on clear and full information (§ 25 TDDDG), whether or not personal data is involved. No consent is needed when it’s only to transmit a message over a public network, or strictly necessary for a service the user explicitly asked for. The authorities expect refusing to be as easy as accepting. Since 1 April 2025 sites may choose to use consent management services recognised by the BfDI (EinwV). Fines go up to €300,000 (§ 28 TDDDG).
Sources: gesetze-im-internet.de/ttdsg/__25.html · datenschutzkonferenz-online.de/media/oh/OH_Digitale_Dienste.pdf · gesetze-im-internet.de/einwv/BJNR0200B0025.html · gesetze-im-internet.de/ttdsg/__28.html
Electronic marketing
Section titled “Electronic marketing”Advertising by email, fax or automated calls needs the recipient’s prior express consent (§ 7 UWG). For email there’s a soft opt-in, where the address came from a sale, it’s used for your own similar products, the customer hasn’t objected, and they’re told they can object at collection and in every message. Phone advertising to consumers needs prior express consent, documented and kept for five years (§ 7a). Calls to businesses need at least presumed consent. The Bundesnetzagentur can fine unlawful calls up to €300,000.
Sources: gesetze-im-internet.de/uwg_2004/__7.html · gesetze-im-internet.de/uwg_2004/__7a.html · gesetze-im-internet.de/uwg_2004/__20.html
Breach notification
Section titled “Breach notification”The GDPR rule applies. Report a breach to your supervisory authority without undue delay and within 72 hours, unless it’s unlikely to risk people’s rights, and tell affected people without undue delay when the risk to them is high. In Germany a notification may only be used in criminal or fine proceedings against the person who made it with their consent (§§ 42(4), 43(4) BDSG).
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · gesetze-im-internet.de/bdsg_2018/__42.html · gesetze-im-internet.de/bdsg_2018/__43.html
Registration and fees
Section titled “Registration and fees”There’s no registration and no fee. If you have a data protection officer, publish their contact details and send them to your supervisory authority (Art. 37(7) GDPR).
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML
Data protection officer
Section titled “Data protection officer”On top of the GDPR, private controllers and processors must appoint a DPO if they usually have at least 20 people constantly working on automated processing of personal data. Headcount doesn’t matter if they do processing that needs a DPIA, or process data commercially for transfer, anonymised transfer, or market or opinion research (§ 38 BDSG). Mandatory DPOs are protected against dismissal. The government plans to reduce company DPOs in small and medium-sized firms. As of 5 November 2026 that’s a plan, and § 38 is unchanged.
Sources: gesetze-im-internet.de/bdsg_2018/__38.html · gesetze-im-internet.de/bdsg_2018/__6.html · bundesregierung.de/resource/blob/2196306/2445592/344cc50b4c10a5939658…
Leads, not sources: dieter-datenschutz.de/magazin/datenschutzbeauftragter-pflicht-abschaf… · dr-datenschutz.de/faellt-die-pflicht-zum-datenschutzbeauftragten-bis-…
International transfers
Section titled “International transfers”The GDPR rules apply. Transfers outside the EEA need an adequacy decision (such as the EU–US Data Privacy Framework for certified companies), appropriate safeguards such as standard contractual clauses or binding corporate rules, or a listed exception. The BDSG adds no transfer rules for businesses.
Sources: bfdi.bund.de/DE/Fachthemen/Datenschutzpraxis/Internationaler-Datentra… · eur-lex.europa.eu/legal-content/EN/TXT/HTML · gesetze-im-internet.de/bdsg_2018
Impact assessments
Section titled “Impact assessments”Carry out a DPIA before high-risk processing (Art. 35 GDPR). For businesses, the DSK’s list names 17 kinds of processing that always need one, such as credit and risk scoring, systematic employee monitoring, tracking shoppers’ movements, large-scale vehicle location data and AI that steers customer contact or assesses people. Needing a DPIA also means you must appoint a DPO (§ 38 BDSG).
Sources: datenschutzkonferenz-online.de/media/ah/20181017_ah_DSK_DSFA_Muss-Lis… · gesetze-im-internet.de/bdsg_2018/__38.html
Automated decisions and AI
Section titled “Automated decisions and AI”Art. 22 GDPR applies. § 37 BDSG allows some fully automated insurance decisions. From 20 November 2026, § 37a replaces § 31. Scores for contract or credit decisions must then use a scientifically recognised statistical method, not be reused, not concern minors and exclude special category, age, gender, name, social media, bank transaction and address data. Credit agencies may count only some unpaid debts. Decisions may be automated, but people can ask how a score was made and get a human decision. The KI-MIG makes the Bundesnetzagentur the main AI Act authority, with BaFin for finance.
Sources: gesetze-im-internet.de/bdsg_2018/__37.html · gesetze-im-internet.de/bdsg_2018/__31.html · recht.bund.de/bgbl/1/2026/139/VO.html · gesetze-im-internet.de/ki-mig/BJNR0DF0B0026.html
Penalties
Section titled “Penalties”GDPR fines apply, up to €20 million or 4% of worldwide annual turnover. Germany adds crimes (§ 42 BDSG), such as knowingly and commercially passing on non-public data of many people without authorisation, with up to three years in prison. National fines reach €50,000 for consumer credit duties (§ 43 BDSG), €300,000 for cookie breaches (§ 28 TDDDG), and €300,000 for unlawful phone advertising and €50,000 for failing to document or keep the consent (§ 20 UWG). Federal public bodies can’t be fined.
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · gesetze-im-internet.de/bdsg_2018/__42.html · gesetze-im-internet.de/bdsg_2018/__43.html · gesetze-im-internet.de/ttdsg/__28.html · gesetze-im-internet.de/uwg_2004/__20.html
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/de.yaml.