Germany BDSG

Bundesdatenschutzgesetz - German Federal Data Protection Act — German Bundestag

Also known as: BDSG, German Federal Data Protection Act, FDPA, Bundesdatenschutzgesetz

Official site Official change log Subscribe to Germany BDSG (RSS)

Current version: BDSG of 30 June 2017 (as last amended on 3 July 2026); Published 3 July 2026. source
Status: In force
Next deadline: 2026-11-20; in 11 days; Amended § 30 on credit databases and the new § 37a on scoring enter into force (Act of 12 May 2026, Article 16(1)) source
Who must comply: Federal public bodies, state public bodies where no state law applies, and private bodies that process personal data in Germany, through a German establishment, or that fall under the GDPR without any EU establishment. source

How it is assessed: Controllers and processors comply themselves; the BDSG adds a data protection officer requirement that reaches further than the GDPR. source
Authority: A federal act of the Bundestag. The Federal Commissioner for Data Protection and Freedom of Information supervises federal public bodies and telecoms providers; state authorities supervise private bodies. source source
Enforced by: State supervisory authorities oversee private bodies; GDPR fines follow the Administrative Offences Act, and the BDSG adds criminal offences of up to three years' imprisonment. source
Last change: None recorded yet

The German federal data protection act that accompanies the GDPR: it sets the national derogations, the rules for public bodies and for employee data, and the powers of the federal and state supervisory authorities.

Recent changes

No changes recorded yet — we are watching, and nothing has been published.

Key dates

Add these dates to your calendar

Amendments

2026-07-03
BDSG of 30 June 2017 (as last amended on 3 July 2026) AmendmentCurrent text
Article 3 of the Act on reducing bureaucracy in the Federal Ministry of the Interior's area rewrites two provisions of the law-enforcement part: processor contracts may be in writing or text form (§ 62(6)), and the records of processing (§ 70(1)). source
More
- Published in BGBl. 2026 I Nr. 199 on 9 July 2026; Article 3 enters into force on the day after promulgation (Article 16(1)).
2026-05-12
Amended on 12 May 2026 (consumer credit and scoring) Amendment
Article 3 of the Act transposing the Consumer Credit Directive (EU) 2023/2225 expands § 30 on credit databases, deletes § 31, adds a new § 37a on scoring and extends the § 43 fines to the new § 30 duties; it enters into force on 20 November 2026. source
More
- New § 30(6): where a creditworthiness assessment involves automated processing, the borrower can demand human intervention, an explanation and a review of the decision.
- New § 37a: probability scores may not use special category data, age, sex, name, social network data, bank account transaction data or address data, and may not concern minors.
2024-05-06
Amended on 6 May 2024 Amendment

Article 7 of the Digital Services Act implementing law updates a cross-reference in § 9(1) to the renamed Telecommunications Digital Services Data Protection Act (TDDDG). source
2017-06-30
BDSG of 30 June 2017 Major version

The new Federal Data Protection Act, adopted as Article 1 of the Act of 30 June 2017, in force since 25 May 2018; it replaced the BDSG of 1990. source

Who it applies to

The BDSG binds federal public bodies and, alongside the GDPR, private bodies processing personal data in Germany; other federal data protection rules take precedence over it.

Public bodies: Federal public bodies, and state public bodies where data protection is not governed by state law and they execute federal law or act as judicial bodies (§ 1(1)). source
Private bodies: Wholly or partly automated processing, or filing-system processing, unless purely personal or household (§ 1(1)), where the controller or processor processes in Germany, acts through a German establishment, or has no EU/EEA establishment but falls under the GDPR (§ 1(4)). source
Other federal law first: Other federal data protection rules take precedence; the BDSG fills the gaps they leave (§ 1(2)). source
Employee data: § 26 sets when employees' personal data may be processed for employment purposes, including the conditions for processing to uncover criminal offences. source

How compliance is assessed

Controllers and processors comply themselves; the BDSG adds a data protection officer requirement that reaches further than the GDPR.

Data protection officer: Private controllers and processors must appoint one if they generally employ at least 20 persons permanently in automated processing, and regardless of headcount where processing needs a GDPR impact assessment or data is processed commercially for transfer or market research (§ 38(1)). source

Enforcement and penalties

State supervisory authorities oversee private bodies; GDPR fines follow the Administrative Offences Act, and the BDSG adds criminal offences of up to three years' imprisonment.

Up to 3 years' imprisonment

Knowingly transferring or making accessible, on a commercial basis and without authorisation, non-public personal data of a large number of people (§ 42(1)). source

Up to 2 years' imprisonment

Processing non-public personal data without authorisation, or obtaining it by false statements, for payment or with intent to enrich or harm (§ 42(2)); prosecuted only on application (§ 42(3)). source

Up to EUR 50,000

Administrative fine for mishandling consumer credit information requests or failing to inform consumers under § 30 (§ 43(1)-(2)). source

Who supervises: The authorities designated under state law supervise private bodies' compliance (§ 40(1)); the Federal Commissioner supervises federal public bodies and telecoms providers (§ 9(1)). source source
GDPR fines procedure: GDPR Article 83 fines are handled under the Administrative Offences Act; the regional court decides on appeals where the fine exceeds EUR 100,000 (§ 41(1)). source
Public bodies: No fines are imposed on authorities and other public bodies (§ 43(3)). source

Documents

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to Germany BDSG (RSS)

At a glance