Processes personal data, in Germany

Gendiagnostikgesetz (GenDG) vom 31. Juli 2009 (BGBl. I S. 2529, 3672), as amended · Read the law's page

• If you are a physician, or a laboratory a physician commissions, and you carry out a genetic examination or analysis, obtain the person's express written consent before the examination or the taking of the sample, after you have explained its nature, significance and scope and allowed reasonable time to decide (GenDG Sections 8 and 9).
• Keep the results of a genetic examination or analysis in the examination records for ten years, destroy them without delay once that period ends or where the person decided they are to be destroyed, and destroy a genetic sample without delay once it is no longer needed for its purpose or consent is withdrawn (Sections 12 and 13).
• If you are an insurer, do not demand a genetic examination or analysis, and do not demand, accept or use the results of earlier ones, before or after the contract, except for the results-based bar in life, occupational disability, earning-capacity and care annuity insurance above EUR 300,000 of benefit or EUR 30,000 of annual pension (Section 18).
• If you are an employer, do not demand a genetic examination or analysis of an employee, or demand, accept or use the results of earlier ones, before or after the employment begins, and do not disadvantage anyone because of their own or a relative's genetic characteristics (Sections 19 and 4).

Messstellenbetriebsgesetz (MsbG), § 52 Abs. 3 · Read the law's page

• If you are a body entitled to process smart metering data under the Act, anonymize or pseudonymize personal data as far as the processing purpose allows (MsbG Section 52, paragraph 3, sentence 1).
• Pseudonymize load profiles and meter-reading series on transmission under Section 60, paragraph 3 for final consumers with annual electricity consumption of up to 6,000 kilowatt hours behind whose grid connection no controllable consumption device and no generation plant under the renewable energy or combined heat and power acts is operated (Section 52, paragraph 3, sentence 3, number 1).
• Resolve a pseudonym only within Sections 66 to 69, in favor of the party entitled and only for compelling reasons, where determinations of the Federal Network Agency so provide (Section 52, paragraph 3, sentence 4).

Bundesdatenschutzgesetz (BDSG) §§ 32, 33, 36 · Read the law's page

• You need not give a person in Germany the information GDPR Article 13(3) requires about a further processing of data you collected from them where it concerns analog data, you write to the person directly, the purpose is compatible with the original one, the contact is not digital and their interest in the information is minor in the circumstances, under BDSG Section 32(1) number 1.
• You need not give that Article 13(3) information where, as a public body, giving it would endanger the proper performance of your tasks, or where giving it would endanger public security or order or otherwise harm the Federation or a Land, and in either case your interest in withholding it outweighs the person's, under BDSG Section 32(1) numbers 2 and 3.
• You need not give that Article 13(3) information where giving it would impair the assertion, exercise or defense of legal claims and your interest in withholding it outweighs the person's, or where it would endanger a confidential transmission of data to public bodies, under BDSG Section 32(1) numbers 4 and 5.
• Where you obtained a person's data in Germany from someone else and, as a public body, giving the information GDPR Article 14(1), (2) and (4) requires would endanger the proper performance of your tasks or public security or order, or otherwise harm the Federation or a Land, so that the person's interest in being informed must give way, you need not give it, under BDSG Section 33(1) number 1.
• If you are a private body, you need not give that Article 14 information where giving it would impair the assertion, exercise or defense of civil-law claims, or where the processing contains data from civil-law contracts and serves to prevent damage from crimes, unless the person's legitimate interest in being informed outweighs yours, or where the competent public authority has found that disclosure would endanger public security or order or otherwise harm the Federation or a Land, under BDSG Section 33(1) number 2.
• Where you withhold information under BDSG Section 32(1) or 33(1), take suitable measures to protect the person's legitimate interests, including making the information named in GDPR Article 13(1) and (2), or Article 14(1) and (2), available to the public in precise, transparent, intelligible and easily accessible form in clear and plain language, and write down why you withheld it; for withholding under Section 32(1) numbers 4 and 5 neither duty applies, under BDSG Section 32(2) and Section 33(2).
• Where you withhold information under BDSG Section 32(1) only because of a temporary obstacle, give it within a reasonable time after the obstacle ends, taking into account the specific circumstances of the processing, and within two weeks at the latest, under BDSG Section 32(3).
• If you are a public body, you need not honor an objection under GDPR Article 21(1) where a compelling public interest in the processing outweighs the person's interests or a legal provision obliges you to process the data, under BDSG Section 36.

Bundesdatenschutzgesetz (BDSG), BGBl. I S. 2097 (2017), as amended · Read the law's page

• Establish and document a lawful basis under GDPR Article 6 before processing any personal data of a person in Germany.
• Where you process employee data, including biometric data for workplace access or time and attendance, satisfy BDSG Section 26(3)'s stricter conditions rather than relying on employee consent alone.

Bundesdatenschutzgesetz (BDSG), § 27 Abs. 3 · Read the law's page

• If you are a controller processing special categories of personal data for scientific or historical research or statistical purposes, anonymize the data as soon as the research or statistical purpose allows, unless legitimate interests of the data subject conflict (BDSG Section 27, paragraph 3, sentence 1).
• Until the data is anonymized, store separately the attributes that allow individual details to be attributed to an identified or identifiable person, and merge them with the individual details only as far as the research or statistical purpose requires (Section 27, paragraph 3, sentences 2 and 3).

Regulation (EU) 2016/679, Arts. 12-21; Bundesdatenschutzgesetz (BDSG) §§ 34, 35 · Read the law's page

• Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Germany within one month of receipt.
• You need not give a person in Germany access under GDPR Article 15 to personal data you keep only because a statutory or bylaw-based retention duty forbids deleting them. You also need not give access to personal data that serve exclusively data backup or data-protection audit, but only where giving access would take disproportionate effort and you have excluded any other use of the data by suitable technical and organisational measures, under BDSG Section 34(1) number 2.
• Where non-automated storage makes erasing a person's data in Germany impossible or disproportionately costly and their interest in erasure is minor, restrict processing of the data instead of erasing it, unless the data were processed unlawfully, under BDSG Section 35(1).

Regulation (EU) 2016/679, Arts. 33-34 · Read the law's page

• Notify the competent data protection authority without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Germany, unless the breach is unlikely to risk their rights and freedoms.
• If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
• Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms.

Regulation (EU) 2016/679, Arts. 44-49 · Read the law's page

• Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Germany outside the European Economic Area.

Regulation (EU) 2016/679, Arts. 82-83; Bundesdatenschutzgesetz (BDSG) §§41-43 · Read the law's page

• Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82.

Fünftes Buch Sozialgesetzbuch (SGB V), §§ 303e Abs. 3 bis 5, 363 Abs. 2 bis 4 und 399 Abs. 1 Nr. 1 und 2 · Read the law's page

• If you are the Research Data Centre, supply the data an entitled user requests anonymized and aggregated, and supply pseudonymized individual records only without visible pseudonyms, with a temporary working number, for processing under your control (SGB V Section 303e, paragraphs 3 and 4).
• If you use data made accessible by the Research Data Centre, use it only for the purposes for which it was made accessible and do not pass it to third parties unless the Research Data Centre approves (Section 303e, paragraph 5, sentence 1).
• Take care not to establish a reference to persons, care providers or payers when you process the data, and report a reference established by accident to the Research Data Centre without delay (Section 303e, paragraph 5, sentences 2 and 3).
• Do not process the data to establish a personal reference, to identify care providers or payers, or to gain knowledge of third parties' trade secrets (Section 303e, paragraph 5, sentence 4).
• If you are responsible for processing in the electronic patient record, pseudonymize and encrypt the data to be transmitted to the Research Data Centre, send only data that was reliably and automatically pseudonymized, and give it a working number (Section 363, paragraphs 2 and 3).

Fünftes Buch Sozialgesetzbuch (SGB V), § 64e Abs. 11a und 11b · Read the law's page

• If you are the platform operator, provide pseudonymized individual records only for processing under your control, only to persons bound to secrecy or committed to it beforehand, and only with measures that prevent the data from being copied (SGB V Section 64e, paragraph 11a).
• If you use data made accessible under the genome sequencing model project, use it only for the purposes for which it was made accessible and do not pass it to third parties unless the platform operator approves (Section 64e, paragraph 11b, sentence 1).
• Take care not to establish a reference to persons or care providers when you process the data, and report a reference established by accident to the platform operator without delay (Section 64e, paragraph 11b, sentences 4 and 5).
• Do not intentionally process the data to establish a personal reference, to identify care providers or to gain knowledge of third parties' trade secrets, except for the case identification by the trust centre that paragraph 9c names (Section 64e, paragraph 11b, sentences 6 and 7).

Entwurf eines Gesetzes zur Modernisierung des Produkthaftungsrechts · Read the law's page

• If you develop or make software, or have it designed or made, you answer as its manufacturer; free and open-source software developed or supplied outside a business activity is outside the definition of a product (§§ 2(1) No. 3 and 3).
• Keep supplying the software updates and upgrades needed to keep the product safe while the product is within your control: if you are able to provide them yourself or through a third party you keep control, and a defect caused by software, by an update or upgrade, or by a missing necessary update is not excused because it arose after you put the product into circulation (§§ 8(2) and 9(2)).
• Meet the product-safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in judging whether it is defective (§ 7 No. 5), and failing a binding product-safety requirement that protects against the injury presumes it defective (§ 20(1) No. 2).
• Account for what your product learns or acquires after it is put into circulation: the effect of that ability is weighed in judging whether it is defective (§ 7 No. 3).
• Keep records you could produce if a court orders disclosure on a claimant's plausible claim; failing to disclose despite the order presumes the product defective (§§ 19(1) and 20(1) No. 1).
• If you hold relevant evidence for a product liability claim against someone else, the court can, on the claimant's application, order you as a third party to disclose it, limited to what is necessary and proportionate, except to the extent you may refuse to testify under sections 383 to 385 of the Code of Civil Procedure (§ 19(1) and (3)).
• If you are a manufacturer outside the EU, your importer into the EU market and your representative appointed in writing and established in the EU are liable as the manufacturer is, and where there is neither, the fulfilment service provider is liable too (§§ 10 and 11).
• If you make a product available in the supply chain without being its manufacturer or importer, or run an online platform that lets consumers conclude distance contracts with traders where the conditions of Article 6(3) of the Digital Services Act are met, you are liable as the manufacturer is when no manufacturer, importer, representative or fulfilment service provider established in the EU can be identified, unless within one month of receiving the injured person's request you name one of them or your own supplier of the product (§§ 12 and 13).
• If you substantially modify a product without the manufacturer's consent and then make it available on the market or put it into operation, you are the manufacturer of the modified product (§ 5(1)).
• Do not rely on a contract term to limit or exclude your liability to an injured person; departing from the Act to their disadvantage is not allowed (§ 18).
• You are excused if you did not put the product into circulation, if the defect results from the product meeting legal requirements, or if the defect could not be recognized according to the objective state of science and technology at the relevant time (§ 9(1)).
• Claims lapse three years after the creditor learned, or should have learned, of the defect, the damage and the identity of the debtor, and expire ten years after the product was put into circulation or into operation, or 25 years for a latent personal injury (§§ 16 and 17).

Gesetz über die Statistik für Bundeszwecke (Bundesstatistikgesetz, BStatG), §§ 16 Abs. 6 und 8, 21 und 22 · Read the law's page

• If you receive factually anonymized individual data from a statistical office for a scientific project, use it only for the purposes for which it was passed on and delete it once the project is carried out (BStatG Section 16, paragraph 8).
• Do not combine individual data from federal statistics, alone or with other information, to establish a reference to a person, enterprise, establishment or workplace outside the tasks of the Act or of the legal provision ordering the statistic (Section 21).

Straßenverkehrsgesetz (StVG), § 63a Abs. 5 · Read the law's page

• If you transmit the position and time data a vehicle with an automated driving function stores to third parties for accident research in connection with an event under Section 7, paragraph 1, transmit it in anonymized form (StVG Section 63a, paragraph 5).

Zehntes Buch Sozialgesetzbuch (SGB X), § 77 · Read the law's page

• If you are a body named in Section 35 of the First Book of the Social Code, transmit social data to persons or bodies in other EU member states, or in states treated as equal to them, only on the grounds Section 77, paragraph 1 lists, and not where the transmission would conflict with the principles in Article 6 of the Treaty on European Union (SGB X Section 77, paragraph 1).
• Transmit social data to a third country or an international organization only where an adequacy decision under Article 45 of the GDPR exists; without one, the transmission is inadmissible, and Section 77, paragraph 3, sentence 2 limits what counts as an important reason of public interest (Section 77, paragraphs 2 and 3).
• Tell the body that receives the social data the purpose for which they are transmitted (Section 77, paragraph 4).

Bundesdatenschutzgesetz (BDSG), § 30 Abs. 2 bis 5, 8 und 9 · Read the law's page

• This law takes effect on 20 November 2026 (Article 16(1) of the Act of 12 May 2026), so the duties below do not bind before that day.
• If you run a credit information database (an Auskunftei) that commercially collects, stores or alters consumers' personal data in order to pass it on, answer information requests on general consumer loans only from lenders that are supervised by the competent financial authority and guarantee full compliance with Regulation (EU) 2016/679 (section 30(2)).
• Make sure your database holds at least consumers' payment arrears on loans, the kind of loan and the identity of the lender; tell the consumer within 30 days of entering an arrears record, and tell them of their rights under Regulation (EU) 2016/679 (section 30(3)).
• Keep procedures that ensure the information in your database is current and accurate, and procedures that make it easier for consumers to complain about the content of your databases, including the data that third parties can obtain from them (section 30(4) and (8)).
• If you lend or arrange general consumer loans, do not process special categories of personal data under GDPR Article 9(1), or personal data from social networks, that may be contained in those databases (section 30(5)).
• These duties also bind providers and intermediaries of the corresponding financing aids under section 506 of the Bürgerliches Gesetzbuch (section 30(9)).