Data protection & privacy law in Germany (2026)

Yes. As an EU/EEA member, Germany applies the GDPR (Regulation (EU) 2016/679) directly, enforced by the Federal Commissioner for Data Protection (BfDI) and the state (Länder) authorities.

The Federal Commissioner for Data Protection (BfDI) and the state (Länder) authorities.

Up to €20 million or 4% of global annual turnover, whichever is higher.

A DPO is required where you carry out large-scale monitoring or process special-category data at scale.

Personal-data breaches must be notified to the supervisory authority within 72 hours of becoming aware.

The GDPR applies directly; the BDSG (Bundesdatenschutzgesetz, entered into force 25 May 2018) fills GDPR opening clauses and covers processing outside GDPR scope (e.g. law enforcement under the LED). It includes stricter German rules on employee/HR data (§26), video surveillance (§4), credit scoring (§31) and mandatory DPO appointment thresholds.

The BfDI supervises federal public bodies, telecoms and postal providers. Each of the 16 federal states runs its own DPA responsible for private-sector and Land-public-sector enforcement; the DSK (Datenschutzkonferenz) coordinates joint positions. Germany is the only EU member state without a single private-sector supervisor.

The Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz transposes the ePrivacy Directive; §25 TDDDG requires prior, GDPR-standard consent for storing or accessing information on user terminal equipment (cookies, SDKs, pixels) unless strictly necessary. Renamed from TTDSG to TDDDG on 14 May 2024 to align with the EU Digital Services Act.

Under §26 TDDDG, the Federal Ministry issued an ordinance recognising certified consent-management services (PIMS-like); operational since 1 April 2025 to reduce repetitive cookie banners. Use is voluntary but confers a compliance safe harbour for accepted consent signals.

GDPR rights apply in full (access, rectification, erasure, portability, objection, restriction, automated-decision safeguards). Controllers must maintain records of processing (Art. 30), notify personal-data breaches to the competent DPA within 72 hours (Art. 33), run DPIAs for high-risk processing, and appoint a DPO where at least 20 persons are permanently engaged in automated personal-data processing (§38 BDSG) or where core activities require it under Art. 37 GDPR.

In 2025 the BfDI fined Vodafone GmbH €45 million (€15m for inadequate oversight of partner agencies; €30m for authentication weaknesses in the MeinVodafone portal enabling unauthorised eSIM access). Länder DPAs (notably Bavaria, NRW, Berlin) issued numerous fines against online shops for using Google Analytics, Meta Pixel or Hotjar without TDDDG-compliant consent.

The April 2025 CDU/CSU–SPD coalition agreement announces centralising private-sector data-protection supervision under a renamed 'Federal Commissioner for Data Utilisation, Data Protection and Freedom of Information', formally anchoring the DSK in the BDSG with authority to issue binding standards, and easing SME obligations. Legislation is pending, so the fragmented Länder model remains in force today.