Germany

A controller must notify the competent Landesdatenschutzbehorde, or the BfDI for the federal public sector and telecommunications and postal providers, without undue delay and within 72 hours where feasible, after becoming aware of a personal data breach, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. No BDSG derogation from this timeline was identified.

The General Data Protection Regulation (GDPR) applies directly in Germany, and the Bundesdatenschutzgesetz (BDSG), BGBl. I S. 2097 (2017) as amended, supplies domestic derogations and procedural rules, most significantly Section 26 (employment data) and Sections 31 and 37 (credit-scoring automated decisions). Lawful bases otherwise follow GDPR Article 6 unmodified.

Enforcement is fragmented across 17 separate authorities: the federal BfDI, whose jurisdiction is limited to the federal public sector, telecommunications carriers, and postal providers, and 16 state Landesdatenschutzbehorden, which supervise the private sector and are each independent of the BfDI and of their own state government.

Transferring personal data of a person in Germany outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the highest Article 83(5) fine tier. The BfDI publishes its own guidance on international transfers but adds no additional national restriction layer beyond General Data Protection Regulation (GDPR). This is a real, structured condition on outbound transfer, not an absence of restriction.

General Data Protection Regulation (GDPR) Articles 12 to 23 apply, including Article 22 rights against solely automated decision-making. BDSG Section 31 supplements this for credit-reporting and scoring agencies specifically.

The CJEU's SCHUFA ruling, Case C-634/21 (OQ v Land Hessen, judgment 7 December 2023), held that automated credit-score generation used determinatively by a third party such as a bank constitutes a decision based solely on automated processing within Article 22(1), which cast doubt on BDSG Section 31's compatibility with the narrow exceptions in Article 22(2)(b). No subsequent German court ruling resolving the Wiesbaden Administrative Court's remand from that reference is identified.

Germany's enforcement structure is 17 separate authorities: the federal BfDI and 16 state Landesdatenschutzbehorden, coordinated on fine calculation by the Datenschutzkonferenz's shared fining model.

BDSG Sections 41 to 43 add domestic criminal offenses on top of General Data Protection Regulation (GDPR) Article 83's administrative fine regime; total BfDI and state fines reached roughly EUR 160 million from 2018 to 2024, with the largest single BfDI action to date, against Vodafone GmbH, totaling EUR 45 million across two March 2025 decisions. Article 82 arms an individual directly, on the same no-seriousness-threshold terms established EU-wide by CJEU C-300/21.

Germany also has a functioning collective-redress channel: the CJEU (Case C-319/20, Verbraucherzentrale Bundesverband v Meta Platforms Ireland) held that Article 80(2) does not preclude a national provision letting consumer-protection associations sue for a GDPR violation without an individual data subject's mandate, and Germany's Verbraucherrechtedurchsetzungsgesetz (VDuG) lets the Verbraucherzentralen bring representative actions on behalf of an unlimited group of consumers for an infringement affecting at least 50 consumers.

General Data Protection Regulation (GDPR) Article 9(1) governs biometric data as a special category. BDSG Section 26(3), the provision governing special category data in employment, was upheld as GDPR-compatible and is the controlling provision for a workplace-deployed biometric time clock, access control, or voice-authentication system; Section 26(1), the general employment lawful-basis clause, was found incompatible with GDPR's own conditions and cannot be relied on alone.

Consent is disfavored as the legal basis in an employment relationship because of the power imbalance, so employers typically rely on necessity under Section 26(3) or Article 9(2) rather than Article 9(2)(a) consent. A voiceprint or faceprint captured for identification is covered identically to a fingerprint; GDPR draws no distinction by modality.

Germany's leading biometric enforcement precedent is the Hamburg Commissioner for Data Protection and Freedom of Information's 2021 order against Clearview AI to delete a German complainant's biometric identifier, the first such order against Clearview worldwide.

Section 202a punishes, with imprisonment of up to three years or a fine, unlawfully obtaining access, for oneself or another, to data that is not intended for oneself and is specially secured against unauthorised access, by overcoming that access security.

Section 202b punishes, with imprisonment of up to two years or a fine, unlawfully obtaining such data for oneself or another using technical means from a non-public data transmission or from a data-processing installation's electromagnetic emissions, unless a more severe provision applies.

Section 202c punishes, with imprisonment of up to two years or a fine, preparing such an offence by producing, obtaining, selling, supplying, distributing or otherwise making accessible passwords or other security codes enabling access to such data, or computer programs designed to commit such an offence.

Section 202d punishes, with imprisonment of up to three years or a fine, obtaining, passing on, distributing or otherwise making accessible data that is not generally accessible and that another person obtained through an unlawful act, in order to enrich oneself or a third party or to harm another, with an exemption for acts performed exclusively in fulfilment of lawful official or professional duties.

Section 303a punishes, with imprisonment of up to two years or a fine, unlawfully deleting, suppressing, rendering unusable or altering data, and the attempt is itself punishable.

Section 303b punishes substantially disrupting a data-processing operation of essential significance to another through such conduct, with imprisonment of up to three years or a fine, rising to up to five years where the data processing is of essential significance to an outside business, undertaking or public authority, and, in especially serious cases, to imprisonment of six months to ten years, a category the statute names as including causing a loss of great magnitude, acting commercially or as a member of a gang formed for repeated computer sabotage, or impairing the population's supply of essential goods or services or the Federal Republic's security.

Because section 202a's offence turns on overcoming an access-security measure, a scraper reading a public, unauthenticated page without defeating any technical access control falls outside a plain reading of the provision.

Text and data mining is defined as the automated analysis of one or more digital or digitised works to derive information, in particular about patterns, trends and correlations. Reproducing lawfully accessible works for text and data mining is permitted, and the reproduction must be deleted once it is no longer needed for that purpose.

This use is permitted only if the rightsholder has not reserved it, and a reservation over a work accessible online is effective only if made in machine-readable form.

This is Germany's transposition of the EU text-and-data-mining exception and its opt-out mechanism, applicable to AI-model training and other automated collection of lawfully accessible text and data, including web-scraped content, and it is expressly extended to the sui generis database right by the database-right provision's own limitations clause.

Reproductions for text and data mining are permitted for purposes of scientific research, without the machine-readable opt-out that limits the general exception, for research organisations (universities, research institutes or other bodies conducting scientific research that pursue no commercial purpose, reinvest all profits into scientific research, or act under a state-recognised public-interest mandate, but excluding an organisation under a private undertaking's determining influence with preferential access to the research results), for publicly accessible libraries and museums and for archives and film- or sound-heritage institutions, and for individual researchers pursuing no commercial purpose.

Those entitled who pursue no commercial purpose may make such reproductions available to a defined circle of persons for their joint scientific research, and to individual third parties to verify the quality of scientific research, but must end that availability once the joint research or the quality check is complete.

Entitled persons and organisations may retain the reproductions, with reasonable security precautions against unauthorised use, for as long as needed for scientific-research purposes or to verify research findings. Rightsholders may take necessary measures to prevent these reproductions from endangering the security and integrity of their networks and databases.

A database is a collection of works, data or other independent elements arranged systematically or methodically and individually accessible, whose obtaining, verification or presentation required a substantial investment by type or extent; the database maker is whoever made that investment.

The maker holds the exclusive right to reproduce, distribute and publicly communicate the database as a whole or a substantial part of it by type or extent, and repeated, systematic reproduction, distribution or communication of insubstantial parts is treated the same way where it conflicts with the database's normal exploitation or unreasonably prejudices the maker's legitimate interests.

The right does not reach reproduction of a substantial part for private use of a database whose elements are not individually electronically accessible, for scientific research, for illustrating teaching, for text and data mining under section 44b, for text and data mining for scientific research under section 60d, or for preservation, and separately permits use in court, arbitral or administrative proceedings and for public-security purposes.

The right lasts fifteen years from the database's publication, or from its making if it was not published within that period.

A contractual term obliging an owner of a lawfully marketed copy of the database, or another person lawfully entitled to use it, to refrain from reproducing, distributing or communicating an insubstantial part of the database is void to the extent that doing so conflicts neither with the database's normal exploitation nor unreasonably prejudices the maker's legitimate interests.

Unfair commercial acts are prohibited generally, and a commercial act directed at or reaching consumers is unfair where it does not conform to professional diligence and is capable of materially influencing the consumer's economic behaviour, alongside a fixed annex of acts that are always unlawful toward consumers.

Separately, a person acts unfairly toward a competitor by denigrating or disparaging that competitor's identifying marks, goods, services, activities, or personal or business circumstances; by asserting or spreading unproven facts capable of damaging a competitor's business or credit; by offering goods or services that imitate a competitor's, where that causes an avoidable deception of buyers about commercial origin, unfairly exploits or impairs the reputation of the imitated goods or services, or was achieved through dishonestly obtained knowledge or documents; or by targeted obstruction of a competitor.

A person who intentionally or negligently commits an unlawful commercial act under these provisions is liable to a competitor for the resulting damage.

Section 30 requires a besonders wichtige Einrichtung or wichtige Einrichtung, as Section 28 defines them against the Anlage 1 and Anlage 2 sector lists, to adopt appropriate, proportionate and effective technical and organisational measures to avoid disruption to the availability, integrity and confidentiality of the network and information systems it uses to provide its services, and to minimise the impact of a security incident, weighing risk exposure, size, implementation cost, and the likelihood and severity of incidents.

The measures must cover at least ten baseline categories: risk analysis and information-security policy, incident handling, business continuity and crisis management, supply-chain security, security in system acquisition and development including vulnerability management and disclosure, evaluation of measures' effectiveness, basic cyber-hygiene training, cryptography, personnel security and access control, and multi-factor or continuous authentication, transposing NIS2 Article 21.

Anlage 2 Nummer 6 names an online marketplace, an online search engine and a social-networking-platform provider among the digital-service providers this duty reaches expressly. Section 38 places implementation and oversight of these measures on the entity's management body, which is liable to the entity for culpable damage under the ordinary rules of company law and must attend regular training on recognising and assessing risk and risk-management practice.

Section 32 requires a besonders wichtige Einrichtung or wichtige Einrichtung to notify a joint reporting office run by the BSI and the Bundesamt für Bevölkerungsschutz und Katastrophenhilfe of a significant security incident on a graduated clock.

It requires an early warning within 24 hours of becoming aware of the incident, stating whether it may be unlawful or malicious or have cross-border effect, followed by a full notification within 72 hours that confirms or updates that assessment with the incident's severity, impact and any indicators of compromise, and an intermediate report on the BSI's request.

A final report is due within one month of the 72-hour notification, or, if the incident is still ongoing at that point, a progress report followed by a final report after its resolution, transposing NIS2 Article 23. A Betreiber kritischer Anlagen must additionally report the type of critical facility and critical service affected and the incident's effect on that service.

Prohibits offering pornographic content in telemedia unless the provider ensures the content is accessible only to adults through a closed user group (geschlossene Benutzergruppe), typically verified by an age verification system (Altersverifikationssystem) assessed against KJM criteria.

Requires providers of platforms accessible to children and teenagers to implement structural precautions: an accessible reporting and remedy procedure, easily findable references to independent counselling and help services, technical tools for parental control, and default settings that limit usage risk with regard to age.

Enforced by the BzKJ, the federal agency created by the same 2021 amendment that also replaced the former Bundespruefstelle fuer jugendgefaehrdende Medien (BPjM, Federal Review Board for Media Harmful to Young Persons).

Requires providers of operating systems commonly used by children and adolescents, as determined by the KJM, to equip their systems with a youth protection device (Jugendschutzvorrichtung) that can be activated, deactivated and adjusted in a simple, easily accessible and secured way and in which a child's age can be set.

Once an age is set, the operating system must restrict browsing to search engines with a secured search function, allow app installation only from distribution platforms whose apps carry a machine readable age label from a KJM recognized automated rating system, and make only age appropriate apps usable unless individually unlocked by the parent.

Under Section 25 these duties apply one year after the KJM publishes its determination of the covered operating systems, which is itself due within one year of the treaty's 1 December 2025 entry into force, so at the latest from 1 December 2027, extended to at most three years for operating systems in a current or completed production cycle, with non updatable systems on devices already sold exempt.

A press publisher, meaning whoever produces a press publication (a collection consisting mainly of journalistic writings, published under a single title on a periodic or regularly updated basis, to inform the public about news or other topics, under the publisher's own editorial responsibility, excluding scientific or academic periodicals), holds the exclusive right to make its press publication, in whole or in part, available online and to reproduce it for that purpose.

The right does not reach the use of facts contained in a press publication, private or non-commercial use by individual users, hyperlinking to a press publication, or the use of single words or very short extracts from one.

The right may not be invoked to the detriment of an author or holder of a related right whose work is contained in the publication, nor to stop a third party's use of works validly licensed to the publication under a simple licence or of works that are already in the public domain. It lasts two years from a press publication's first appearance. The currently consolidated text does not apply to publications first published before 6 June 2019.

Authors and holders of related rights are entitled to an appropriate share, at least one third, of the publisher's revenue from exercising this right, an entitlement that can be reduced against their interest only by an agreement resting on a common remuneration rule or a collective bargaining agreement. That entitlement can be asserted only through a collecting society.

The general limitations of German copyright law, including the text-and-data-mining exception and the quotation right, apply correspondingly to the press-publisher right.

Reproducing, distributing, and publicly communicating a published work for the purpose of quotation is permitted, provided the extent of the use is justified by the specific quotation purpose.

The statute names three illustrative cases: individual works incorporated after publication into an independent scientific work to explain its content, passages of a work cited after publication in an independent work of language, and individual passages of a published musical work cited in an independent musical work.

The quotation privilege covers use of an illustration or other reproduction of the quoted work even where that reproduction is itself separately protected by a copyright or related right. No decision applying this provision specifically to a news aggregator's reproduction of headlines or snippets was verified against a primary source.