Home › IT Law › Data Protection
We advise companies, public bodies and start-ups on data protection law: setting up a data protection organisation that stands up to scrutiny, specific projects such as cloud migration or the introduction of AI, and the moment something goes wrong, whether that is a data breach, a subject access request or fine proceedings.
Data protection in Germany: the legal framework in 2026
The starting point is the General Data Protection Regulation (GDPR), which applies directly. The German Federal Data Protection Act (BDSG) supplements it, for example on data protection officers (Section 38 BDSG) and video surveillance of publicly accessible areas (Section 4 BDSG). Cookies, tracking and access to end devices are governed by Section 25 of the Telecommunications Digital Services Data Protection Act (TDDDG), known until May 2024 as the TTDSG. Since May 2024 the duty to provide a website legal notice is set out in Section 5 of the Digital Services Act (DDG), no longer in the Telemedia Act (TMG).
Other rules increasingly affect personal data without being called data protection law: the EU Data Act for data from connected products, the AI Act for AI systems, NIS2 and the new Act on the Federal Office for Information Security (BSIG) for information security, and the EU Digital Services Act for platforms. In projects we review these rules together, so that you do not end up with three separate compliance workstreams.
Our data protection pages
- Reporting a data breach: the 72-hour deadline under Art. 33 GDPR, notifying data subjects under Art. 34, documentation.
- Fines and damages (in German): defence in fine proceedings, resisting claims under Art. 82 GDPR.
- Data processing agreements (in German): contracts under Art. 28 GDPR, sub-processors, audit rights.
- International data transfers (in German): EU-US Data Privacy Framework, standard contractual clauses, transfer impact assessments.
- Cookies and tracking (in German): consent under Section 25 TDDDG, consent banners, analytics and marketing tools.
Obligations that apply to almost every business
| Obligation | Provision | In practice |
|---|---|---|
| Record of processing activities | Art. 30 GDPR | The basis of any regulatory audit; the exemption for small businesses rarely applies. |
| Privacy notices | Art. 13, 14 GDPR | Website, recruitment, customer and supplier data, video surveillance. |
| Data protection officer | Art. 37 GDPR, Section 38 BDSG | Generally required where 20 or more people are regularly engaged in automated processing, and for processing that requires a DPIA. |
| Technical and organisational measures | Art. 32 GDPR | Access concepts, encryption, backups, logging, regular review. |
| Data breach notification | Art. 33, 34 GDPR | 72 hours from awareness to the supervisory authority; set up internal reporting lines in advance. |
| Data subject rights | Art. 15 to 22 GDPR | Access requests generally within one month; they are often used tactically in employment or contract disputes. |
Damages under Art. 82 GDPR: a real liability risk
According to the Court of Justice of the EU, non-material damages do not require a threshold of seriousness. In the Facebook scraping case, the German Federal Court of Justice held that the mere loss of control over personal data can constitute damage (BGH, judgment of 18 November 2024, VI ZR 10/24) and considered an amount of around EUR 100 appropriate in that case. Individual awards are therefore often small. After a security incident, however, mass claims backed by litigation funders can add up quickly.
How we work
- Review: we examine your record of processing, privacy notices, processing agreements and deletion concept and list the gaps by priority.
- Projects: for new systems such as CRM, HR software, cloud or AI applications, we check the legal basis, contracts, third-country transfers and the need for a DPIA before the contract is signed.
- Incidents: after a data breach we help with assessment, notification and communication within the 72 hours, together with IT forensic experts if you wish.
- Disputes: we represent you before supervisory authorities, in fine proceedings and in court, for example in access and damages claims.
The European Commission has proposed changes to the GDPR and the cookie rules as part of the Digital Omnibus, including on the definition of personal data and on consent for access to end devices. To our knowledge, this part has not been adopted as of November 2026. Until then, the GDPR and Section 25 TDDDG apply unchanged.
Frequently asked questions
Do we need an external data protection officer?
The obligation to appoint one follows from Section 38 BDSG and Art. 37 GDPR. Whether an internal or external officer makes more sense depends on size, sector and possible conflicts of interest. Managing directors and heads of IT should not take on the role themselves.
What does a data protection breach cost?
Art. 83 GDPR allows fines of up to EUR 20 million or 4 per cent of worldwide annual turnover. In practice, damages claims, warning letters from competitors and the cost of investigation and communication often weigh more heavily than the fine.
May we enter customer data into AI tools?
Only with a legal basis, a suitable contract with the provider and a resolved third-country transfer. With enterprise versions these points can usually be addressed; with freely available consumer tools, generally not. We recommend an internal AI policy that sets out which data may go into which tools.
How quickly must we answer a subject access request?
As a rule within one month of receipt (Art. 12(3) GDPR). For complex requests the period can be extended by two months, but the extension must be communicated with reasons within the first month.
Related topics
Contact us
Do you have a specific data protection question, a data breach or a letter from a supervisory authority? Call us on +49 511 35 73 56-0 or email info@itrechtler.de.