{
  "node_id": "de-bdsg-2018",
  "title": "Germany Federal Data Protection Act 2018 (Bundesdatenschutzgesetz, BDSG)",
  "domain": "Legal & IP Sovereignty",
  "version": "1.0.0",
  "last_updated": "2026-04-27",
  "bluf": "The Federal Data Protection Act 2018 (Bundesdatenschutzgesetz, BDSG) is Germany's principal data protection statute, entering into force on 25 May 2018 to supplement and implement the EU General Data Protection Regulation 2016/679 (GDPR) at national level. The BDSG is enforced by the Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragte für den Datenschutz und die Informationsfreiheit, BfDI) for federal public bodies and by the sixteen state (Land) data protection authorities (Landesdatenschutzbehörden) for state public bodies and private entities. § 1 confirms that the BDSG supplements GDPR and applies where Union law does not provide complete rules, or where Union law opens national scope for supplementary legislation under Article 6(2), Article 9(4), and Article 88 GDPR. § 22 opens the special categories of personal data prohibition in Article 9(1) GDPR for German-specific purposes including employment and social security law, vital interests, non-profit associations, medical treatment, public health, archiving, scientific research, and the administration of justice. § 26 is the principal German-specific provision governing data processing in employment relationships (implementing the Article 88 GDPR opening): employers may process personal data of employees where necessary for the establishment, implementation, or termination of the employment relationship; for detecting criminal offences where there is documented factual cause and processing is proportionate; or for compliance with obligations arising from collective agreements or works council agreements. Consent in employment contexts must be assessed for voluntariness given the dependency relationship, though consent may be valid in certain cases such as advantages for the employee. § 38 requires private sector controllers and processors to appoint a Data Protection Officer (DPO) where 20 or more persons are constantly engaged with automated personal data processing; the DPO must be appointed before processing begins, may be internal or external, must be expert in data protection law and practice, and has statutory independence. § 42 prescribes criminal penalties of imprisonment up to two years (or three years in aggravated cases) for intentional commercial disclosure of personal data of a large number of persons without authorisation, or for processing for personal or third-party enrichment or to cause harm. § 43 sets out administrative fines of up to EUR 50,000 for violations of BDSG-specific provisions (distinct from and in addition to GDPR Article 83 fines of up to EUR 20 million or 4% of worldwide annual turnover).",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "ai_overlay_2026"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "gdpr-article-5-data-principles",
    "coe-convention-108-plus",
    "iso-27001-2022"
  ],
  "primary_citations_count": 7
}