GDPR Article 82, BDSG Sections 41-43, and BfDI and Landesdatenschutzbehörden Enforcement in Germany

Criminal exposureYes

Private right of actionYes

Criminal exposure note

BDSG Section 42 creates two federal criminal offences layered on top of the GDPR's purely administrative fines. Section 42(1): knowingly and without authorisation transmitting to a third party, or otherwise making accessible, not-generally-accessible personal data of a large number of people, done commercially, carries imprisonment of up to three years or a fine. Section 42(2): processing not-generally-accessible personal data without authorisation, or obtaining it by false pretences, done for payment or with intent to enrich oneself or another or to harm another, carries imprisonment of up to two years or a fine. Both offences are prosecuted only on complaint (Section 42(3)), and only the data subject, the controller, the Federal Commissioner for Data Protection and Freedom of Information (BfDI), or the competent supervisory authority may bring one.

Penalty structure

GDPR Article 83(5) sets the higher administrative-fine tier a German Land data protection authority applies, up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher, for the gravest infringement categories. The narrower Article 83(4) tier, up to EUR 10,000,000 or 2 percent, applies instead to the controller and processor obligations in Articles 25 to 39. BDSG Section 43 layers a separate, much narrower national administrative fine on top of this EU-wide ceiling: mishandling a credit-information request under BDSG Section 30(1), or failing to properly or timely inform a consumer under Section 30(2) sentence 1, is a Germany-specific administrative offence (Ordnungswidrigkeit) carrying a fine of up to EUR 50,000, and Section 43(3) exempts public authorities and other public bodies from this fine entirely. Section 41 applies the Ordnungswidrigkeitengesetz's general administrative-offence procedure to GDPR Article 83(4) to (6) violations, with two of its provisions (Sections 17, 35 and 36 OWiG) disapplied.

Rule

Higher of

As of

2 September 2026

Currency

EUR

Fixed cap

20,000,000

Turnover percentage cap

4

Enforcement body

Germany has a split structure. Under BDSG Section 40(1), the data protection authority of each of the 16 Laender supervises GDPR compliance by private-sector bodies (nichtoeffentliche Stellen) established or operating in that Land; there is no single national private-sector regulator. The Federal Commissioner for Data Protection and Freedom of Information (BfDI) instead supervises federal public bodies and specific federally regulated sectors (telecommunications and postal services) under separate BDSG provisions. The Laender authorities and the BfDI coordinate through the Datenschutzkonferenz (DSK), a non-statutory conference, rather than a single hierarchical regulator.

Obligation class

Governance