Bundesdatenschutzgesetz (BDSG)

What does the Federal Data Protection Act regulate?

The BDSG in its current version has applied since 25 May 2018, at the same time as the GDPR. The GDPR takes precedence as an EU regulation. The BDSG may supplement it only where it expressly permits (opening clauses). Key content for companies:

• Data protection officer: Under § 38 BDSG, companies generally must appoint a data protection officer if at least 20 persons are permanently engaged in the automated processing of personal data.
• Special categories: § 22 BDSG regulates when health data or other sensitive data may be processed.
• Data subject rights: The BDSG contains restrictions, for example on the right to erasure if erasure would be disproportionate in the case of non-automated processing.
• Criminal and administrative fine provisions: Supplementary sanctions for certain violations.

This entry does not replace legal advice.

BDSG and retired IT

For retirement, the principles and security obligations of the GDPR matter most. The BDSG is added, for example, when employee data or special categories of data reside on old devices. For persons bound by professional secrecy, criminal law also applies, see Professional secrecy (§ 203 StGB). How to hand over data carriers in a legally compliant way overall is shown in the guide Disposing of data carriers in GDPR-compliant fashion. At Second IT, employees are bound to data secrecy, and NDAs are possible.

Frequently asked questions about the BDSG

Does the BDSG still apply alongside the GDPR?

Yes. The GDPR applies directly; the BDSG supplements it in the areas that the GDPR leaves to the member states.

What is the difference between the BDSG and the GDPR?

The GDPR is EU law and applies in all member states. The BDSG is a German federal law with supplementary rules, for example on data protection officers and employee data protection.

Do I have to erase old devices differently under the BDSG than under the GDPR?

No, the BDSG does not prescribe its own erasure method. The obligations for secure processing and documentation under the GDPR are decisive.

When must I appoint a data protection officer under the Federal Data Protection Act?

As a rule, if at least 20 persons are permanently engaged in the automated processing of personal data. This is regulated by § 38 BDSG. The GDPR additionally names its own cases in which an appointment may be necessary.

What does the BDSG regulate on health data?

§ 22 BDSG regulates when health data and other special categories of personal data may be processed. This is also important for old devices on which such sensitive data may reside. The entry does not replace legal advice.