Deutschland · Bundesdatenschutzgesetz (BDSG)
TL;DR
Websites targeting users in Germany must comply with GDPR as implemented locally through the Bundesdatenschutzgesetz (BDSG). The supervisory authority is the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI). Notable enforcement: H&M fined for employee surveillance (€35.3 million). Use our free scanner below to check your website instantly.
Free audit — 25+ automated checks in 60 seconds
Scan My Website Free →Authority
Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)
Website
www.bfdi.bund.de ↗Local Law
Bundesdatenschutzgesetz (BDSG)
Language
German
Largest Fine
€35.3 million
Population
84 million
Strict consent requirements — opt-in required before any tracking
Works councils must be consulted on employee data processing
Data Protection Officer (DPO) mandatory for companies with 20+ employees processing personal data
TTDSG (Telekommunikation-Telemedien-Datenschutz-Gesetz) governs cookies and tracking
Double opt-in required for email marketing
Stricter rules for employee monitoring than EU baseline
Germany has 16 state-level DPAs in addition to the federal BfDI, making enforcement one of the strictest in Europe. German courts have been particularly aggressive on cookie consent enforcement, including issuing fines for Google Fonts loaded without consent.
Cookie consent banner that requires opt-in before non-essential cookies
Privacy policy available in German
Clear identification of data controller and contact details
Data Processing Agreement (DPA) with all third-party processors
Lawful basis documented for each processing activity
Data Subject Access Request (DSAR) process in place
Data breach notification procedure compliant with 72-hour rule
Data Protection Impact Assessment for high-risk processing
International data transfer mechanisms documented (SCCs, adequacy decisions)
Records of processing activities (ROPA) maintained
In Germany, websites must comply with GDPR as implemented by the Bundesdatenschutzgesetz (BDSG). Key requirements include obtaining explicit consent before setting non-essential cookies, providing a clear privacy policy, appointing a DPO when required, and notifying data breaches within 72 hours to the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI).
The Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) is the supervisory authority responsible for enforcing data protection laws in Germany. They can investigate complaints, conduct audits, and issue fines up to €20 million or 4% of annual global turnover.
Use PrivacyChecker's free scanner to perform an instant audit of your website. Our tool checks 25+ compliance points including cookie consent, privacy policy presence, security headers, tracker detection, and more — all relevant to Germany's GDPR requirements.
Find out in 60 seconds with our free GDPR scanner
Run Free Audit →