Germany Federal Data Protection Act (BDSG)

Germany

vConsolidated text as last amended by Art. 3 of the Act of 3 July 2026 (BGBl. 2026 I Nr. 199), retrieved 2026-09-30; official English translation as at Art. 10 of the Act of 23 June 2021

4 domains

68 controls

Germany's Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) of 2017, the national law that implements and supplements the GDPR and transposes the Law Enforcement Directive. It sets the German rules on employee data (s 26, read after the Court of Justice's C-34/21 ruling as a necessity test on top of a GDPR legal basis), video surveillance of publicly accessible spaces (s 4), the 20-person data protection officer threshold (s 38), special categories, scoring and the limits on data subject rights, and the full regime for police and prosecution authorities. Built from the current German consolidation (to 3 July 2026) read with the official English translation.

Verified

Germany Federal Data Protection Act (BDSG) is a compliance framework from Germany with 4 domains and 68 controls that map to 2 other frameworks. The largest domains are Part 3: processing by competent authorities for law enforcement (Directive (EU) 2016/680) – Germany Federal Data Protection Act (BDSG) (33 controls), Part 2: implementing provisions for processing under the GDPR (employment, special categories, rights, private-sector DPOs) – Germany Federal Data Protection Act (BDSG) (23 controls), Part 1: common provisions (public bodies, video surveillance, data protection officers) – Germany Federal Data Protection Act (BDSG) (10 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard Blokdyk

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (4)

Part 1: common provisions (public bodies, video surveillance, data protection officers) – Germany Federal Data Protection Act (BDSG)

10 controls

Controls in the Part 1: common provisions (public bodies, video surveillance, data protection officers) – Germany Federal Data Protection Act (BDSG) domain of Germany Federal Data Protection Act (BDSG) — 10 controls
Code	Title	Description
germany-federal-data-protection-act-bdsg::s16-4	s 16(4) Give the Federal Commissioner access to premises, equipment, data and information	Public bodies of the Federation must give the Federal Commissioner and staff access at any time to all official premises...
germany-federal-data-protection-act-bdsg::s3	s 3 Public bodies process personal data only where needed for their task or official authority	A public body may process personal data where that is necessary to carry out a task it is responsible for or to exercise...
germany-federal-data-protection-act-bdsg::s4-1	s 4(1) Video surveillance of publicly accessible spaces only where necessary for a listed purpose	Watching publicly accessible spaces by optical-electronic means (video surveillance) is lawful only to the extent needed...
germany-federal-data-protection-act-bdsg::s4-2	s 4(2) Make video surveillance and the controller identifiable at the earliest possible point	The operator must use suitable measures, such as signs placed before the monitored area is entered, so that people can s...
germany-federal-data-protection-act-bdsg::s4-3	s 4(3) Store and use video data only for the stated purpose, with narrow onward uses	Recordings made under s 4(1) may be stored or used where needed to achieve the purpose pursued and nothing indicates tha...
germany-federal-data-protection-act-bdsg::s4-4	s 4(4) Inform a person when video data are attributed to them	Where video data are linked to a particular individual, that individual must be informed of the processing as required b...
germany-federal-data-protection-act-bdsg::s4-5	s 4(5) Delete video data without delay once no longer needed	Video data must be erased without undue delay when they are no longer necessary for the purpose or when the legitimate i...
germany-federal-data-protection-act-bdsg::s5	s 5 Public bodies designate a qualified data protection officer and publish the contact details	Every public body, including public-law enterprises competing in the market, must designate a data protection officer; o...
germany-federal-data-protection-act-bdsg::s6	s 6 Involve, resource and protect the data protection officer	The public body involves the officer properly and early in every data protection matter, provides the resources, access...
germany-federal-data-protection-act-bdsg::s7	s 7 Give the data protection officer at least the statutory tasks and avoid conflicts	Beyond the GDPR tasks, the officer of a public body at least informs and advises the body and its staff on their obligat...

Part 2: implementing provisions for processing under the GDPR (employment, special categories, rights, private-sector DPOs) – Germany Federal Data Protection Act (BDSG)

23 controls

Controls in the Part 2: implementing provisions for processing under the GDPR (employment, special categories, rights, private-sector DPOs) – Germany Federal Data Protection Act (BDSG) domain of Germany Federal Data Protection Act (BDSG) — 23 controls
Code	Title	Description
germany-federal-data-protection-act-bdsg::s22	s 22 Process special categories only on a listed national ground and with specific safeguards	In derogation from GDPR Art. 9(1), special categories may be processed by public and private bodies where necessary for...
germany-federal-data-protection-act-bdsg::s23	s 23 Public bodies further process data for another purpose only on a listed ground	A public body may process data for a purpose other than that of collection where needed for its tasks and the data subje...
germany-federal-data-protection-act-bdsg::s24	s 24 Private bodies reuse data for another purpose only for security, prosecution or legal claims	A private body may process data for a purpose other than that of collection only where needed to avert dangers to the se...
germany-federal-data-protection-act-bdsg::s25	s 25 Public bodies transfer data to other bodies only on the listed conditions and with purpose binding	A public body may transfer data to another public body where needed for either body's tasks and s 23 would permit the pr...
germany-federal-data-protection-act-bdsg::s26-1	s 26(1) sentence 1 Process employee data only where necessary for the employment relationship, on a GDPR legal basis	Section 26(1) sentence 1 describes when employees' data may be processed for employment purposes: where necessary to dec...
germany-federal-data-protection-act-bdsg::s26-1-s2	s 26(1) sentence 2 Investigate suspected crimes by employees only on documented suspicion and proportionately	Employees' data may be processed to uncover criminal offences only where documented factual indications support a suspic...
germany-federal-data-protection-act-bdsg::s26-2	s 26(2) Rely on employee consent only where it is genuinely voluntary, in the required form and with text-form notice	Where employee data are processed on consent, voluntariness is judged by how dependent the employee is on the employer a...
germany-federal-data-protection-act-bdsg::s26-3	s 26(3) Process employees' special category data only for labour and social law duties, or on explicit consent	In derogation from GDPR Art. 9(1), special categories of employees' data (health, biometrics used for identification, tr...
germany-federal-data-protection-act-bdsg::s26-4	s 26(4) Where a collective or works agreement governs employee data, meet GDPR Art. 88(2)	Collective agreements (collective bargaining agreements, works agreements and service agreements) may form the basis for...
germany-federal-data-protection-act-bdsg::s26-5	s 26(5) Take measures to ensure the GDPR principles are met in employee data processing	The controller puts suitable measures in place so that, above all, the principles of GDPR Art. 5 (lawfulness, fairness a...
germany-federal-data-protection-act-bdsg::s27	s 27 Research and statistics: balance interests, safeguard, anonymise early and separate identifiers	Special categories may be processed for scientific or historical research or statistics even without consent where neces...
germany-federal-data-protection-act-bdsg::s28	s 28 Archiving in the public interest: safeguard special categories and record counter-statements	Special categories may be processed where necessary for archiving in the public interest, with s 22(2) measures. Access...
germany-federal-data-protection-act-bdsg::s29	s 29 Apply the secrecy exceptions to information, access and breach notice narrowly	The GDPR Art. 14 information duty does not apply as far as meeting it would disclose information that is confidential by...
germany-federal-data-protection-act-bdsg::s30	s 30 Treat EU lenders' credit enquiries like domestic ones, and tell consumers promptly when credit is refused	A body that commercially collects, stores or changes data usable to assess consumers' creditworthiness in order to trans...
germany-federal-data-protection-act-bdsg::s31	s 31 Use scores for contract decisions only on the statutory conditions	A probability value about a natural person's future conduct (a score) may be used to decide on entering into, performing...
germany-federal-data-protection-act-bdsg::s32	s 32 Withhold collection-time information on further use only in the listed cases, with compensating steps	Beyond GDPR Art. 13(4), information on intended further use under Art. 13(3) need not be given where it concerns analogu...
germany-federal-data-protection-act-bdsg::s33	s 33 Withhold information on data obtained from others only in the listed cases, with compensating steps	Beyond GDPR Art. 14(5) and s 29(1), the Art. 14(1), (2) and (4) information need not be given by a public body where it...
germany-federal-data-protection-act-bdsg::s34	s 34 Refuse access only on the listed grounds, document why and tell the data subject	On top of the exceptions in ss 27, 28 and 29, the GDPR Art. 15 right of access is excluded where information is withheld...
germany-federal-data-protection-act-bdsg::s35	s 35 Restrict instead of erasing only in the listed cases, and tell the data subject	Where erasure of non-automated data is impossible or disproportionate because of the storage method and the data subject...
germany-federal-data-protection-act-bdsg::s36	s 36 Public bodies: honour objections unless a compelling public interest or a legal duty prevails	The right to object under GDPR Art. 21(1) against a public body does not apply where a pressing public interest in the p...
germany-federal-data-protection-act-bdsg::s37	s 37 Insurance: automated decisions only where the request is met or with human review rights	Beyond GDPR Art. 22(2)(a) and (c), a decision made purely by automated means is allowed in providing services under an i...
germany-federal-data-protection-act-bdsg::s38	s 38 Private bodies designate a data protection officer at 20 persons, or regardless of size for high-risk processing	In addition to GDPR Art. 37(1)(b) and (c), controllers and processors must designate a data protection officer where the...
germany-federal-data-protection-act-bdsg::s40-4-5	s 40(4), (5) Give the Land supervisory authority information and tolerate on-site inspections	Bodies subject to supervision and their managers must give the supervisory authority, on request, the information it nee...

Part 3: processing by competent authorities for law enforcement (Directive (EU) 2016/680) – Germany Federal Data Protection Act (BDSG)

33 controls

Controls in the Part 3: processing by competent authorities for law enforcement (Directive (EU) 2016/680) – Germany Federal Data Protection Act (BDSG) domain of Germany Federal Data Protection Act (BDSG) — 33 controls
Code	Title	Description
germany-federal-data-protection-act-bdsg::s47	s 47 Apply the six principles to law enforcement processing	Personal data must be processed lawfully and fairly; gathered for defined, explicit and legitimate purposes and not used...
germany-federal-data-protection-act-bdsg::s48	s 48 Process special categories only where strictly necessary and with safeguards	Special categories may be processed only where strictly necessary for the controller's tasks, with appropriate safeguard...
germany-federal-data-protection-act-bdsg::s49	s 49 Further process for another purpose only within s 45 purposes or where a law allows	Processing for a purpose other than that of collection is allowed where the new purpose is one of the s 45 purposes, the...
germany-federal-data-protection-act-bdsg::s50	s 50 Use archival, scientific or statistical forms only in the public interest and with safeguards	Data may be processed within s 45 purposes in archival, scientific or statistical form where the public interest is serv...
germany-federal-data-protection-act-bdsg::s51	s 51 Where the law allows consent, obtain valid consent and be able to prove it	Where a law permits processing on consent, the controller has to be able to show that consent was given; a request withi...
germany-federal-data-protection-act-bdsg::s52	s 52 Staff and processors act only on the controller's instructions	Any person working under the controller's or processor's authority who has access to personal data may process them only...
germany-federal-data-protection-act-bdsg::s53	s 53 Bind staff to data confidentiality on taking up duties	Persons employed in data processing may not process personal data without authorisation (data secrecy). They must be com...
germany-federal-data-protection-act-bdsg::s54	s 54 Automated individual decisions only when authorised by law, never discriminatory	A decision made purely by automated means with an adverse legal effect or significant effect on the data subject is allo...
germany-federal-data-protection-act-bdsg::s55	s 55 Publish general information about the processing	The controller must make general, publicly accessible information available on the purposes of processing, data subjects...
germany-federal-data-protection-act-bdsg::s56	s 56 Where a law requires notification, include the minimum content, and defer only on listed grounds	Where other legislation requires notifying data subjects (such as after covert measures), the notification contains at l...
germany-federal-data-protection-act-bdsg::s57	s 57 Answer access requests with the listed information, and handle refusals through the Federal Commissioner	On request, the controller confirms whether data are processed and provides the data and categories, available informati...
germany-federal-data-protection-act-bdsg::s58	s 58 Rectify, erase or restrict on request, inform recipients and give written reasons for refusals	Inaccurate data are rectified without delay (for statements and assessments accuracy concerns the fact of the statement,...
germany-federal-data-protection-act-bdsg::s59	s 59 Communicate clearly, free of charge, in the form of the request	The controller communicates concisely, intelligibly, accessibly and in plain language, answering in the form the request...
germany-federal-data-protection-act-bdsg::s62	s 62 Use processors only with sufficient guarantees and a binding written or electronic contract	Where others process on its behalf, the controller remains responsible and data subjects exercise their rights against i...
germany-federal-data-protection-act-bdsg::s63	s 63 Joint controllers set out their responsibilities in an agreement	Controllers who decide purposes and means together set out their respective tasks and responsibilities transparently in...
germany-federal-data-protection-act-bdsg::s64	s 64 Implement risk-based security measures, including the fourteen control objectives for automated processing	Controller and processor implement technical and organisational measures giving security appropriate to the risk, partic...
germany-federal-data-protection-act-bdsg::s65	s 65 Notify the Federal Commissioner of breaches within 72 hours and document all breaches	The controller reports a personal data breach to the Federal Commissioner promptly and where possible within 72 hours of...
germany-federal-data-protection-act-bdsg::s66	s 66 Tell data subjects of breaches likely to pose a substantial risk	Where a breach probably creates a substantial risk for individuals' protected interests, the controller notifies the dat...
germany-federal-data-protection-act-bdsg::s67	s 67 Assess the impact before high-risk processing and involve the Federal Commissioner	Where a type of processing, particularly with new technologies, probably creates a substantial risk for data subjects' p...
germany-federal-data-protection-act-bdsg::s68	s 68 Cooperate with the Federal Commissioner	The controller must cooperate with the Federal Commissioner in the performance of the Commissioner's tasks.
germany-federal-data-protection-act-bdsg::s69	s 69 Consult the Federal Commissioner before high-risk processing in a new filing system	Before processing in a new filing system, the controller consults the Commissioner where the impact assessment shows sub...
germany-federal-data-protection-act-bdsg::s70	s 70 Keep records of processing activities	The controller keeps a record covering every category of processing activity, with contact details (and joint controller...
germany-federal-data-protection-act-bdsg::s71	s 71 Build in data protection by design and by default	When determining the means and when processing, the controller takes appropriate measures to implement the principles, s...
germany-federal-data-protection-act-bdsg::s72	s 72 Distinguish between categories of data subjects	As far as possible the controller clearly distinguishes suspects, persons about to offend, convicted persons, victims or...
germany-federal-data-protection-act-bdsg::s73	s 73 Distinguish facts from personal assessments	As far as possible the controller distinguishes data based on facts from data based on personal assessments, marks asses...
germany-federal-data-protection-act-bdsg::s74	s 74 Check quality before transmitting data and pass on processing conditions	The controller takes appropriate measures so that inaccurate or outdated data are not transmitted, checks quality before...
germany-federal-data-protection-act-bdsg::s75	s 75 Rectify and erase, and set time limits for erasure or review	The controller rectifies inaccurate data and erases data without delay where processing is unlawful, legally required to...
germany-federal-data-protection-act-bdsg::s76	s 76 Log collection, alteration, consultation, disclosure, combination and erasure	Controllers and processors keep logs in automated systems of at least collection, alteration, consultation, disclosure i...
germany-federal-data-protection-act-bdsg::s77	s 77 Be able to receive confidential reports of data protection violations	The controller makes sure it is able to take in reports, in confidence, of breaches of data protection law within its ar...
germany-federal-data-protection-act-bdsg::s78	s 78 Transfer to third countries only to competent bodies with adequacy, and control onward transfers	If all other conditions are met, data may be transferred to third-country bodies or international organisations responsi...
germany-federal-data-protection-act-bdsg::s79	s 79 Without adequacy, transfer on appropriate safeguards, document it and report annually	Without an adequacy decision, transfers meeting s 78 are allowed where a legally binding instrument provides appropriate...
germany-federal-data-protection-act-bdsg::s80	s 80 Transfer without safeguards only on the listed necessity grounds and document it	Without adequacy or safeguards, transfers meeting the other s 78 requirements are allowed only where necessary to protec...
germany-federal-data-protection-act-bdsg::s81	s 81 Transfer directly to other third-country recipients only exceptionally and with purpose instructions	In special individual cases, controllers may transfer directly to third-country recipients other than competent bodies w...

Part 4: processing outside the scope of the GDPR and the Directive – Germany Federal Data Protection Act (BDSG)

2 controls

Controls in the Part 4: processing outside the scope of the GDPR and the Directive – Germany Federal Data Protection Act (BDSG) domain of Germany Federal Data Protection Act (BDSG) — 2 controls
Code	Title	Description
germany-federal-data-protection-act-bdsg::s85	s 85 Outside EU law, transfer for defence and crisis tasks only with purpose instructions, and apply the information exemptions narrowly	Outside the scope of the GDPR and the Directive, transfers to third countries, supranational or intergovernmental bodies...
germany-federal-data-protection-act-bdsg::s86	s 86 State awards and honours: process only what is needed and safeguard special categories	To prepare and carry out state award and honour procedures, the bodies responsible, and any other public or private body...

Maps to 2 other frameworks

68 total controls

GDPR

58 source controls mapped|32 target controls covered

85%

ISO 27002:2022

5 source controls mapped|5 target controls covered

Compare Germany Federal Data Protection Act (BDSG) with GDPR

Coverage is not the same as your position

This page shows what Germany Federal Data Protection Act (BDSG) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is Germany Federal Data Protection Act (BDSG) and who does it apply to?

Germany Federal Data Protection Act (BDSG) is a compliance framework from Germany with 4 domains and 68 controls. Germany's Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) of 2017, the national law that implements and supplements the GDPR and transposes the Law Enforcement Directive. It sets the German rules on employee data (s 26, read after the Court of Justice's C-34/21 ruling as a necessity test on top of a GDPR legal basis), video surveillance of publicly accessible spaces (s 4), the 20-person data protection officer threshold (s 38), special categories, scoring and the limits on data subject rights, and the full regime for police and prosecution authorities. Built from the current German consolidation (to 3 July 2026) read with the official English translation. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does Germany Federal Data Protection Act (BDSG) actually require?

Germany Federal Data Protection Act (BDSG) has 68 controls organised across 4 domains. The largest domains are Part 3: processing by competent authorities for law enforcement (Directive (EU) 2016/680) – Germany Federal Data Protection Act (BDSG) (33 controls), Part 2: implementing provisions for processing under the GDPR (employment, special categories, rights, private-sector DPOs) – Germany Federal Data Protection Act (BDSG) (23 controls), Part 1: common provisions (public bodies, video surveillance, data protection officers) – Germany Federal Data Protection Act (BDSG) (10 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of Germany Federal Data Protection Act (BDSG) do I already cover?

Germany Federal Data Protection Act (BDSG) maps to 2 other compliance frameworks. The top mapping partners are GDPR (85% coverage), ISO 27002:2022 (7% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement Germany Federal Data Protection Act (BDSG)?

Start your Germany Federal Data Protection Act (BDSG) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Germany Federal Data Protection Act (BDSG) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 68 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 844 frameworks.

Get Started Free →

Free forever — no credit card required