The German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) is a German law governing the protection of personal data. It supplements the directly applicable General Data Protection Regulation (GDPR) with national provisions and specifies certain data protection requirements in greater detail. Among other things, the BDSG contains provisions on employee data protection, the processing of special categories of personal data and the appointment of data protection officers.
What does the Federal Data Protection Act regulate?
The BDSG contains national data protection provisions for public and private bodies. It regulates certain areas in which the GDPR permits supplementary or derogating national provisions.
Its main areas of regulation include:
- Employee data protection
- Special categories of personal data
- Data protection officers
- Data subject rights
- Data protection supervision
In addition, the BDSG contains specific provisions governing the processing of personal data by competent authorities for the prevention, investigation, detection or prosecution of criminal offences, as well as the execution of criminal penalties.
The Act is therefore an important component of German data protection law, but it does not replace the general requirements of the GDPR.
What is the difference between the BDSG and the GDPR?
The GDPR is a regulation of the European Union that applies directly in the Member States. It sets out the fundamental requirements for the processing of personal data.
The BDSG, by contrast, is a national law that supplements these European provisions in certain areas.
The GDPR contains so-called opening clauses, which allow Member States to regulate certain data protection matters in greater detail through national legislation.
On this basis, the BDSG may establish additional requirements or specify certain matters more precisely.
One example is the appointment of data protection officers. While Article 37 GDPR sets out the basic requirements, Section 38 BDSG provides for additional national appointment obligations for private bodies.
National provisions must be compatible with the applicable EU law. Where the GDPR applies directly and does not permit supplementary or derogating national provisions, the BDSG cannot override its requirements.
Who is subject to the Federal Data Protection Act?
The scope of application of the BDSG is determined in particular by Section 1 BDSG.
Subject to the conditions set out therein, the Act applies to both public and private bodies.
Public bodies
These include, in particular, federal authorities and other public institutions of the Federal Government.
The provisions of the BDSG apply to public bodies of the federal states only under the statutory conditions. The individual federal states also have their own data protection laws.
Private bodies
These include, for example, private businesses, associations and other entities organised under private law.
The BDSG applies to them in particular where personal data are processed wholly or partly by automated means, as well as in certain cases of non-automated processing forming part of a filing system.
The processing of personal data by natural persons exclusively for personal or household activities is generally outside this scope of application.
Whether a specific provision of the BDSG applies depends, however, on the circumstances of the case and the statutory scope of that provision.
Not every provision of the BDSG applies equally to all businesses and public authorities.
Practical example: Appointment of a data protection officer
A medium-sized business employs 35 people.
Of these, 24 are regularly and permanently engaged in the automated processing of personal data, for example in human resources administration, customer support and order processing.
The business assesses whether it is required to appoint a data protection officer.
Under Section 38(1) BDSG, such an obligation generally arises where at least 20 persons are usually and permanently engaged in the automated processing of personal data.
As 24 people in the business meet this requirement, a data protection officer must be appointed.
This example illustrates how the BDSG supplements the general provisions of the GDPR with additional national requirements.
legal data assessment: Businesses should not consider the GDPR and the BDSG in isolation from one another. The decisive factor is which European and national provisions apply to the particular processing activity. A careful assessment of the statutory requirements is advisable, particularly in relation to the appointment of data protection officers, employee data protection and the processing of special categories of personal data. This helps identify data protection obligations at an early stage and reduce legal risks.
Legal bases
German Federal Data Protection Act (BDSG), in particular Section 1 (Scope of application), Section 22 (Processing of special categories of personal data), Section 26 (Data processing for the purposes of the employment relationship), Sections 32–35 (Restrictions on data subject rights) and Section 38 (Data protection officers of private bodies); supplemented in particular by Articles 6, 9, 23, 37 and 88 GDPR.
Frequently asked questions about the Federal Data Protection Act (BDSG)
What is the Federal Data Protection Act?
The Federal Data Protection Act is a German data protection law that supplements the GDPR in certain areas. Among other things, it contains provisions on employee data protection, data protection officers and the processing of special categories of personal data.
What is the difference between the BDSG and the GDPR?
The GDPR is directly applicable European law and sets out the fundamental data protection requirements. The BDSG is a national law that supplements or specifies these requirements within the framework of EU law.
Does the BDSG also apply to private businesses?
Yes. Subject to the conditions set out in Section 1 BDSG, the Act also applies to private bodies, such as private businesses and associations. Which individual provisions apply depends on the circumstances of the case.
Does the BDSG remain in force alongside the GDPR?
Yes. The BDSG continues to apply alongside the GDPR. However, its provisions are applicable only insofar as they are compatible with overriding EU law and the relevant statutory requirements are met.
Which areas of data protection does the BDSG regulate?
The BDSG contains supplementary national provisions covering various areas of data protection law. These include, in particular, employee data protection, the processing of special categories of personal data, the appointment of data protection officers and certain restrictions on data subject rights.
Related terms.
Employee data protection Employee data protection governs the protection of employees' personal data in the employment relationship. Employers may only process employee data where a legal basis exists and the applicable data protection requirements are met. The key legal framework is the General Data Protection Regulation (GDPR), together with the European legal requirements governing the protection of employee data. Protected information includes, among other things, job application documents, salary data, health information and details of work performance. Data protection officer (DPO) A Data Protection Officer (DPO) is a qualified individual who advises companies and public authorities on compliance with data protection laws and monitors their implementation. Under certain circumstances, appointing a DPO is mandatory pursuant to Article 37 of the General Data Protection Regulation (GDPR) and Section 38 of the German Federal Data Protection Act (BDSG). The DPO’s responsibilities and independent position are governed in particular by Articles 38 and 39 GDPR. 