GDPR in Germany
In addition to the GDPR, the German Federal Data Protection Act (BDSG) and the Telecommunications Digital Services Data Protection Act (TDDDG, rules on cookies and similar technologies) apply. Germany has supervisory authorities at federal and state level; the competent authority depends on where your German establishment is located.
When things go wrong
Data breaches – ransomware, misdirected emails, lost devices – are time-critical. Notification to the supervisory authority is generally due within 72 hours of becoming aware of the breach, and data subjects must be informed if there is a high risk. Cybersecurity reporting duties under NIS-2 may apply in parallel. We assist immediately with assessment, notifications and communication, and afterwards in proceedings before authorities and in defending damages claims.
Case studies: Data Protection & GDPR
Ransomware attack on a German subsidiary
Data processing framework for a platform
Mass damages claims after a data leak
The examples are typical, anonymised and simplified scenarios from our practice. Every case is different – the outcome depends on the individual circumstances.
Our services: Data Protection & GDPR
- GDPR compliance programmes
- Data processing and joint controller agreements
- International data transfers
- Data breach response (72 hours)
- Access requests and data subject rights
- Supervisory authority proceedings and damages claims
How we work with you
FAQ: Data Protection & GDPR
When must a data breach be notified?
Whenever a personal data breach occurs, unless it is unlikely to result in a risk to the rights of individuals. Notification must be made without undue delay and, where feasible, within 72 hours.
Do we need a data protection officer in Germany?
Generally yes, if at least 20 persons are regularly engaged in automated processing of personal data, or regardless of headcount for particularly high-risk processing.
What fines can be imposed?
Up to EUR 20 million or 4 % of global annual turnover, plus orders, damages claims and warning letters from competitors or associations.
Send us your enquiry
All fields are optional. Only provide what you wish.
