Germany BDSG (Federal Data Protection Act)Supported in OneClickComply

Meet Germany's BDSG data protection rules alongside the GDPR

The BDSG (Bundesdatenschutzgesetz) is Germany's Federal Data Protection Act, the national law that supplements and specifies the GDPR in Germany. The current Act dates from 30 June 2017 and has applied since 25 May 2018, replacing the earlier BDSG.

See the BDSG requirements

Official name: Bundesdatenschutzgesetz (Federal Data Protection Act) of 30 June 2017
In force since: 25 May 2018, alongside the GDPR
Relationship to GDPR: Supplements and specifies the GDPR using its opening clauses
Enforced by: The Federal Commissioner (BfDI) for federal bodies and Länder supervisory authorities for private bodies

BDSG mapped

Automated evidence

Continuous monitoring

Who needs BDSG

Is BDSG right for your organisation?

It uses the GDPR's opening clauses to set German rules on employee data, data protection officers, special category data, scoring, data subject rights and criminal offences.

The BDSG applies to private organisations that process personal data in Germany, and to federal public bodies, in addition to the GDPR. It matters most when you employ staff in Germany, have a German establishment, or process data at a scale that triggers its data protection officer rule. German customers often ask for evidence of GDPR and BDSG compliance during procurement and due diligence.

How we help

How OneClickComply helps with BDSG

OneClickComply supports the BDSG today, so the controls and evidence you hold for the GDPR and ISO 27001 can be reused against BDSG sections rather than rebuilt. OneClickComply collects security evidence automatically, generates privacy and security policies from your real environment, and tracks processors through vendor risk management. Our in-house audit team can advise on German specifics, such as data protection officer duties, through Ask an Auditor.

Requirements covered

86 sections across 4 parts: common provisions (Sections 1 to 21), GDPR implementing rules (Sections 22 to 44), law enforcement processing under Directive (EU) 2016/680 (Sections 45 to 84) and special provisions (Sections 85 and 86).

Official name: Bundesdatenschutzgesetz (Federal Data Protection Act) of 30 June 2017
In force since: 25 May 2018, alongside the GDPR
Relationship to GDPR: Supplements and specifies the GDPR using its opening clauses
Enforced by: The Federal Commissioner (BfDI) for federal bodies and Länder supervisory authorities for private bodies
Data protection officer: Required where at least 20 people regularly process personal data by automated means (Section 38)
Criminal penalties: Up to three years' imprisonment for certain unauthorised commercial disclosures of personal data (Section 42)
Assessment route: No BDSG certification; compliance is shown through documentation and supervisory oversight
Type: Law (mandatory)
Region: Germany, EU
In OneClickComply: Supported today

Already working towards another framework?

ISO 2700115% shared
SOC 280% shared
NIST CSF60% shared
GDPR70% shared

Share of BDSG controls covered by each framework in OneClickComply's mappings. Evidence collected once counts towards both.

Why automate

Manual BDSG compliance vs OneClickComply

Doing it manually

Working out where the BDSG adds to or differs from the GDPR
Repeating GDPR work for Germany because nothing maps across
Chasing screenshots to prove security measures are in place
Keeping processor records and contracts current by hand
Finding security gaps only after a breach has to be reported

With OneClickComply

Ask an Auditor gives expert guidance on BDSG specifics
Control mapping reuses your GDPR evidence across BDSG sections
Evidence is collected automatically from connected tools
Vendor risk management keeps processor records up to date
Continuous monitoring alerts you when security controls drift

Capabilities

Everything you need for BDSG

Map existing GDPR and ISO 27001 controls to BDSG sections
Collect security evidence automatically from 13,000+ integrations
Generate privacy and security policies with AutoComplete
Monitor technical safeguards continuously, with drift alerts
Assess processors and vendors through vendor risk management
Get guidance on German data protection officer duties via Ask an Auditor

How it works

Three steps to BDSG compliance

Connect and scan
Connect your cloud, identity and SaaS tools. OneClickComply checks them against BDSG and shows which controls pass and which fail.
Fix and generate
OneClickFix fixes supported misconfigurations automatically, and AutoComplete drafts BDSG policies from your real environment.
Monitor and evidence
Continuous monitoring flags drift as it happens, and our in-house audit team is on hand when you need expert guidance.

See how far your current setup is from BDSG.

Requirements

Germany BDSG (Federal Data Protection Act) requirements

All 86 sections of the BDSG across its four parts; Sections 22 to 44 hold the GDPR implementing rules most relevant to private organisations, and Sections 45 to 84 apply to law enforcement processing.

Reference	Requirement
Section 1	Scope of the Act
Section 2	Definitions (Parts 1 and 2)
Section 3	Processing of personal data by public bodies
Section 4	Video surveillance of publicly accessible spaces
Section 5	Designation of data protection officers of public bodies
Section 6	Position of the data protection officer
Section 7	Tasks of the data protection officer
Section 8	Establishment of the Federal Commissioner
Section 9	Competence of the Federal Commissioner
Section 10	Independence of the Federal Commissioner
Section 11	Appointment and term of office
Section 12	Official relationship
Section 13	Rights and obligations of the Federal Commissioner
Section 14	Tasks of the Federal Commissioner
Section 15	Activity reports
Section 16	Powers of the Federal Commissioner
Section 17	Representation on the European Data Protection Board, single contact point
Section 18	Cooperation among federal and Länder supervisory authorities
Section 19	Responsibilities of the lead supervisory authority
Section 20	Judicial remedy
Section 21	Court decision where an adequacy decision is believed unlawful
Section 22	Processing of special categories of personal data
Section 23	Processing for other purposes by public bodies
Section 24	Processing for other purposes by private bodies
Section 25	Transfer of data by public bodies
Section 26	Data processing for employment-related purposes
Section 27	Processing for scientific or historical research and statistical purposes
Section 28	Processing for archiving purposes in the public interest
Section 29	Data subject rights and supervisory powers where secrecy obligations apply
Section 30	Consumer loans
Section 31	Scoring and credit reports
Section 32	Information where data are collected from the data subject
Section 33	Information where data are not obtained from the data subject
Section 34	Right of access by the data subject
Section 35	Right to erasure
Section 36	Right to object
Section 37	Automated individual decision-making, including profiling
Section 38	Data protection officers of private bodies
Section 39	Accreditation of certification bodies
Section 40	Supervisory authorities of the Länder
Section 41	Application of criminal and administrative fine procedures
Section 42	Penal provisions
Section 43	Provisions on administrative fines
Section 44	Proceedings against a controller or processor
Section 45	Scope of Part 3 (law enforcement processing)
Section 46	Definitions for law enforcement processing
Section 47	General principles for processing personal data
Section 48	Special categories of data in law enforcement processing
Section 49	Processing for other purposes (law enforcement)
Section 50	Processing for archiving, scientific and statistical purposes
Section 51	Consent
Section 52	Processing on instructions from the controller
Section 53	Confidentiality
Section 54	Automated individual decision (law enforcement)
Section 55	General information on data processing
Section 56	Notification of data subjects
Section 57	Right of access (law enforcement)
Section 58	Right to rectification, erasure and restriction of processing
Section 59	Modalities for exercising data subject rights
Section 60	Right to lodge a complaint with the Federal Commissioner
Section 61	Legal remedies against decisions or inaction of the Federal Commissioner
Section 62	Processing carried out on behalf of a controller
Section 63	Joint controllers
Section 64	Requirements for the security of data processing
Section 65	Notifying the Federal Commissioner of a personal data breach
Section 66	Notifying data subjects of a personal data breach
Section 67	Data protection impact assessment
Section 68	Cooperation with the Federal Commissioner
Section 69	Prior consultation of the Federal Commissioner
Section 70	Records of processing activities
Section 71	Data protection by design and by default
Section 72	Distinction between categories of data subjects
Section 73	Distinction between facts and personal assessments
Section 74	Procedures for data transfers
Section 75	Controller duties to rectify, erase and restrict data
Section 76	Logging
Section 77	Confidential reporting of violations
Section 78	General requirements for international transfers
Section 79	Data transfers with appropriate safeguards
Section 80	Data transfers without appropriate safeguards
Section 81	Other data transfers to recipients in third countries
Section 82	Mutual assistance
Section 83	Compensation
Section 84	Penal provisions for law enforcement processing
Section 85	Processing outside the scope of the GDPR and Directive (EU) 2016/680
Section 86	Processing for government awards and honours

Always check the official text of BDSG for the exact wording.

FAQs

BDSG questions, answered

Can't find what you need? Our in-house auditors can talk you through BDSG on a 30-minute call.

What is the BDSG?

The BDSG (Bundesdatenschutzgesetz) is Germany's Federal Data Protection Act. The current version, dated 30 June 2017, has applied since 25 May 2018 and works alongside the GDPR rather than replacing it. It uses the GDPR's opening clauses to set German rules on topics such as employee data, data protection officers, special category data, credit scoring, limits on data subject rights and criminal offences for misuse of personal data.

Does the BDSG replace the GDPR in Germany?

No. The GDPR applies directly in Germany and takes precedence, and the BDSG supplements it. Organisations must comply with both: the GDPR sets the core rules on lawful processing, rights, security and breach notification, while the BDSG fills in areas where the GDPR lets member states legislate, such as employment data, data protection officer thresholds and restrictions on certain data subject rights.

Who must comply with the BDSG?

The BDSG applies to federal public bodies and to private organisations that process personal data in Germany. Its private sector rules cover controllers and processors established in Germany and, in some cases, those outside the EU whose processing falls under the GDPR. Any company employing staff in Germany or processing German personal data should check which BDSG sections apply, especially those on employee data and data protection officers.

When does a German company need a data protection officer?

Under Section 38 BDSG, a private controller or processor must appoint a data protection officer if it regularly has at least 20 people permanently engaged in the automated processing of personal data. A data protection officer is required regardless of headcount if the organisation carries out processing that needs a data protection impact assessment, or processes personal data commercially for transfer or for market or opinion research.

What are the penalties under the BDSG?

Most data protection fines in Germany are imposed under the GDPR itself, with the BDSG setting how those fine proceedings run. The BDSG adds its own criminal offences: Section 42 provides for imprisonment of up to three years or a fine for deliberately disclosing or commercially exploiting non-public personal data of a large number of people without authorisation. Section 43 allows fines of up to 50,000 euros for specific consumer loan breaches.

How does the BDSG treat employee data?

Section 26 BDSG sets German rules for processing employee personal data for employment purposes, including hiring, running and ending employment, detecting crime in the workplace, and processing based on employee consent or collective agreements. Its general clause has been called into question by a 2023 Court of Justice of the EU ruling, so employers should take legal advice and also rely on the GDPR's own legal bases.

How does the BDSG relate to ISO 27001?

The BDSG is a legal requirement, while ISO 27001 is a voluntary, certifiable standard for information security management. ISO 27001 does not prove BDSG compliance, but its controls help meet the security expectations that the GDPR and BDSG place on controllers and processors. Mapping one set of controls to both lets the same evidence support your security certification and your German data protection obligations.

Does OneClickComply support the BDSG?

Yes. OneClickComply supports the BDSG today. Your existing GDPR and ISO 27001 controls and evidence are mapped to BDSG sections, and our in-house audit team can help you interpret German specific requirements. OneClickComply does not certify BDSG compliance, as no official certification exists.

Related frameworks

All frameworks

Products

Start working towards BDSG

Automate controls, gather evidence continuously and stay audit-ready, all on one platform.

Meet Germany's BDSG data protection rules alongside the GDPR

Is BDSG right for your organisation?

How OneClickComply helps with BDSG

Manual BDSG compliance vs OneClickComply

Everything you need for BDSG

Three steps to BDSG compliance

Connect and scan

Fix and generate

Monitor and evidence