GermanyBundesdatenschutzgesetz (BDSG), Federal Data Protection Act
Bundesdatenschutzgesetz (BDSG), BGBl. I S. 2097 (2017), as amended
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Establish and document a lawful basis under General Data Protection Regulation (GDPR) Article 6 before processing any personal data of a person in Germany.
- Where you process employee data, including biometric data for workplace access or time and attendance, satisfy BDSG Section 26(3)'s stricter conditions rather than relying on employee consent alone.
These lines are LexLint's reading of the law's text. Also read by: Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder (Datenschutzkonferenz, joint body of the German data protection authorities) (guidance, recorded ); Case C-34/21 Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums, judgment of the Court of Justice of (First Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0034
- Guidance link
- https://www.datenschutzkonferenz-online.de/media/kp/dsk_kpnr_14.pdf
- Case citation
- Case C-34/21 Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums, judgment of the Court of Justice of (First Chamber)
- Guidance body
- Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder (Datenschutzkonferenz, joint body of the German data protection authorities)
- Open questions
- Does Section 26(1) sentence 1 of the Bundesdatenschutzgesetz satisfy the conditions of Article 88(2) of Regulation (EU) 2016/679, so that it can apply as a more specific rule on employee data, after the Court of Justice's ruling in Case C-34/21?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
To process an employee's personal data in order to detect a crime, the employer needs documented factual indications that found the suspicion. The section names no format, owner or period for the documentation.
- Kind
- Explicit
- As of
- Provision
- BDSG Section 26, paragraph 1, sentence 2
- Trigger
- personal_data_processing
What this law does
The General Data Protection Regulation (GDPR) applies directly in Germany, and the Bundesdatenschutzgesetz (BDSG), BGBl. I S. 2097 (2017) as amended, supplies domestic derogations and procedural rules, most significantly Section 26 (employment data), Section 31 (scoring and credit reports) and Section 37 (automated decisions in insurance).
The BDSG adds rules of its own on the lawfulness of processing beside GDPR Article 6, in Section 4 (video surveillance), Section 22 (special categories), Section 24 (further use for other purposes) and Section 26 (employment). Enforcement is divided between the federal BfDI and the supervisory authorities of the Laender. The BfDI supervises federal public bodies and companies providing telecommunications services under BDSG Section 9(1).
The BfDI also supervises companies providing postal services, under Section 71(1) of the Postgesetz. The authorities designated under Land law supervise private-sector bodies under BDSG Section 40(1). The independent data protection authorities of the federation and the Laender make up the Datenschutzkonferenz.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .