Germany

Tier 1 Comprehensive law Europe

Germany applies the GDPR (cross-refer instrument id gdpr) supplemented by the federal BDSG and 16 Land data protection acts. It is the canonical Pattern 3 jurisdiction: the substantive private-sector law does not fork, but the regulator does — 16 Land authorities plus the federal BfDI, with competence split by establishment and sector. Germany is also a rare EU member imposing criminal data-protection offences that can carry imprisonment, and sets a stricter headcount-based DPO trigger than the GDPR requires.

At a glance

Principal law: GDPR supplemented by the Bundesdatenschutzgesetz (BDSG) and 16 Land acts
Regulator: 16 Land data protection authorities plus the federal BfDI
Maximum penalty: GDPR ceiling (higher of EUR 20m or 4% global turnover); plus BDSG sec. 42 criminal penalties up to 3 years' imprisonment
DPO required: Yes — at 20+ persons in automated processing (sec. 38 BDSG), stricter than GDPR
National implementing act: Bundesdatenschutzgesetz (BDSG) 2017

Structure

Structural pattern: Pattern 3 — uniform private law, devolved public sector
Sub-jurisdictions: 0 (regulator-and-public-sector-only)
ISO code: DE

Regulators

Federal Commissioner for Data Protection and Freedom of Information BfDI
Federal public bodies; telecommunications and postal sectors.
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information) LfDI Baden-Württemberg
Baden-Württemberg: Public bodies of the Land and private/non-public sector within Baden-Württemberg.
Bayerisches Landesamt für Datenschutzaufsicht (Bavarian State Office for Data Protection Supervision) BayLDA
Bayern (private sector): Non-public/private sector only (companies, associations, freelancers) in Bavaria. Seat: Ansbach. Bavaria is the only Land with a split authority.
Der Bayerische Landesbeauftragte für den Datenschutz (Bavarian State Commissioner for Data Protection) BayLfD
Bayern (public sector): Public bodies of the Free State of Bavaria only. Seat: Munich.
Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information) BlnBDI
Berlin: Public bodies of the Land and private/non-public sector within Berlin.
Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (State Commissioner for Data Protection and the Right to Access Files) LDA Brandenburg
Brandenburg: Public bodies of the Land and private/non-public sector within Brandenburg.
Die Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen LfDI Bremen
Bremen: Public bodies of the Land and private/non-public sector within Bremen. Office located in Bremerhaven.
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (Hamburg Commissioner for Data Protection and Freedom of Information) HmbBfDI
Hamburg: Public bodies of the Land and private/non-public sector within Hamburg. Issued the H&M fine (h-m-2020).
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information) HBDI
Hessen: Public bodies of the Land and private/non-public sector within Hesse.
Der Landesbeauftragte für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern LfDI M-V
Mecklenburg-Vorpommern: Public bodies of the Land and private/non-public sector within Mecklenburg-Vorpommern.
Die Landesbeauftragte für den Datenschutz Niedersachsen (State Commissioner for Data Protection Lower Saxony) LfD Niedersachsen
Niedersachsen: Public bodies of the Land and private/non-public sector within Lower Saxony.
Die Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen LDI NRW
Nordrhein-Westfalen: Public bodies of the Land and private/non-public sector within North Rhine-Westphalia.
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz LfDI RLP
Rheinland-Pfalz: Public bodies of the Land and private/non-public sector within Rhineland-Palatinate.
Unabhängiges Datenschutzzentrum Saarland (Independent Data Protection Centre Saarland) UDS
Saarland: Public bodies of the Land and private/non-public sector within Saarland.
Die Sächsische Datenschutz- und Transparenzbeauftragte (Saxon Commissioner for Data Protection and Transparency) SDTB
Sachsen: Public bodies of the Land and private/non-public sector within Saxony. Title now includes "Transparenz"; mailbox domain sdtb.sachsen.de.
Landesbeauftragte für den Datenschutz Sachsen-Anhalt LfD Sachsen-Anhalt
Sachsen-Anhalt: Public bodies of the Land and private/non-public sector within Saxony-Anhalt.
Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (Independent State Centre for Data Protection) ULD
Schleswig-Holstein: Public bodies of the Land and private/non-public sector within Schleswig-Holstein.
Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit TLfDI
Thüringen: Public bodies of the Land and private/non-public sector within Thuringia.

Transfers and adequacy

EU member: Yes
EEA member: Yes
Holds EU adequacy: Yes

Intra-EU; not a third country. GDPR applies directly.

Instruments

GDPR

Tier 1 · comprehensive

Regulation (EU) 2016/679 (General Data Protection Regulation)

BDSG

Tier 1 · implementing

BDSG of 30 June 2017 (BGBl. I p. 2097), as amended

Sources

Secondary Germany Data Privacy Laws: GDPR, BDSG & Enforcement Guide (2026) Recording Law

Never independently verified — seeded from the prototype.