Data Protection And Cybersecurity Laws In Germany

Data protection

1. Local data protection laws and scope

Data processing operations are governed by the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG) of 30 June 2017, as last amended by Article 12 of the Second Act to Adapt the Data Protection Law to Regulation (EU) 2016/679 and to Implement Directive (EU) 2016/680 of 20 November 2019 (Zweites Gesetz zur Anpassung des Datenschutzrechts an die Verordnung (EU) 2016/679 und zur Umsetzung der Richtlinie (EU) 2016/680 (Zweites Datenschutz-Anpassungs- und Umsetzungsgesetz EU – 2. DSAnpUG-EU)). Unless sector-specific data protection laws take precedence over the BSDG, the BDSG applies to:

• data processing by federal public authorities or public authorities of the German federal states, if the data protection laws of the German federal states do not apply and;