GermanyGDPR Articles 12-21 and BDSG Sections 34 and 35, Data Subject Rights in Germany
Regulation (EU) 2016/679, Arts. 12-21; Bundesdatenschutzgesetz (BDSG) §§ 34, 35
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Germany within one month of receipt.
- You need not give a person in Germany access under General Data Protection Regulation (GDPR) Article 15 to personal data you keep only because a statutory or bylaw-based retention duty forbids deleting them. You also need not give access to personal data that serve exclusively data backup or data-protection audit, but only where giving access would take disproportionate effort and you have excluded any other use of the data by suitable technical and organisational measures, under BDSG Section 34(1) number 2.
- Where non-automated storage makes erasing a person's data in Germany impossible or disproportionately costly and their interest in erasure is minor, restrict processing of the data instead of erasing it, unless the data were processed unlawfully, under BDSG Section 35(1).
These lines are LexLint's reading of the law's text. Also read by: Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder (Datenschutzkonferenz) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.datenschutzkonferenz-online.de/media/kp/dsk_kpnr_6.pdf
- Guidance body
- Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder (Datenschutzkonferenz)
- Open questions
- Do the limits on access in Section 34(1) number 2 of the Bundesdatenschutzgesetz apply to a controller's refusal at all, given the primacy of Regulation (EU) 2016/679 and its Article 23, which the Datenschutzkonferenz leaves to a decision in each individual case?
What record it asks for
What the log must hold
Decision basis
Logging duty
A controller that refuses a person access under GDPR Article 15 on a Section 34(1) ground must document the reasons for the refusal. GDPR Articles 12 to 21 and BDSG Section 35 set no record of their own. For a federal public body that gives no access, Section 34(3) has the information given to the Federal Commissioner on the person's request; the paragraph says nothing of who may inspect the documented reasons or how long they are kept.
- Kind
- Explicit
- As of
- Provision
- BDSG Section 34, paragraph 2, sentence 1
- Trigger
- personal_data_processing
What this law does
Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Germany can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests. BDSG Sections 34 and 35 narrow the rights of access and erasure for any controller.
Section 34(1) number 2 removes the access right for data kept only because a statutory or bylaw-based retention duty forbids deleting them. Section 34(1) number 2 also removes it for data kept exclusively for data backup or data-protection audit, but only where access would take disproportionate effort and processing for any other purpose is excluded by suitable technical and organisational measures.
Section 35 replaces erasure with restriction where non-automated storage makes erasure impossible or disproportionately costly and the person's interest in erasure is minor, unless the data were processed unlawfully.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .