Berufsgeheimnis (§ 203 StGB)

Medical practices, law firms, tax offices and insurers regularly replace notebooks, PCs and servers. These devices hold patient records, client files or health data. For these professional groups, criminal law applies alongside the GDPR: § 203 StGB protects professional secrecy. This glossary entry explains what the provision regulates, whom it affects and what to watch for when decommissioning IT.

What does § 203 StGB say?

A secret within the meaning of the provision is a fact known only to a limited circle of persons and whose confidentiality the person concerned has a legitimate interest in. This includes, for example, diagnoses, the content of a mandate or a client's financial circumstances. Anyone who discloses such a secret without authorization, that is, makes it accessible to a third party, commits a criminal offense.

The penalty is imprisonment of up to one year or a fine. If the offender acts for payment or with the intent to enrich themselves or harm another, the range rises to up to two years (§ 203 para. 6 StGB). The offense is prosecuted only upon complaint (§ 205 StGB). Intentional conduct is punishable, and conditional intent suffices: it is enough if someone considers the disclosure possible and accepts it.

Who is bound by professional secrecy?

§ 203 para. 1 StGB lists the professions exhaustively. Para. 2 extends the circle to public officials and persons specifically obligated for public service. The most important groups at a glance:

Area	Examples from § 203 para. 1 and 2 StGB	Typical data on old devices
Healthcare professions	Physicians, dentists, veterinarians, pharmacists, other healthcare professions with state-regulated training, professional psychologists	Patient records, findings, billing data
Legal and tax advice	Lawyers, patent attorneys, notaries, auditors, tax advisors	Client files, contracts, tax returns
Counseling and social services	Marriage, family and youth counselors, addiction counselors, social workers	Conversation notes, case files
Insurances	Members of private health, accident and life insurers, private medical billing agencies	Health information, insurance claims
Public service	Public officials and persons specifically obligated (para. 2)	Citizen and procedural data

Many of these data are also special categories of personal data under Art. 9 GDPR, such as health data. For them, protection under criminal law and data protection law applies side by side.

External service providers as "participating persons"

It used to be unclear whether a practice or law firm could engage an IT service provider at all who might see data in the process. The Act on the Reform of the Protection of Secrets in the Participation of Third Parties, in force since November 2017, clarified this. Since then:

• Permitted: Persons bound by professional secrecy may make secrets accessible to "other participating persons" insofar as this is necessary for their activity (§ 203 para. 3 StGB). This also includes external service providers for IT operations, data erasure or disposal.
• Punishable for the service provider: Anyone who, as a participating person, discloses a secret without authorization is themselves liable to prosecution (§ 203 para. 4 sentence 1 StGB).
• Obligation for the client: The person bound by professional secrecy commits an offense if they have not ensured that the participating person was obliged to maintain confidentiality, and that person then discloses a secret (§ 203 para. 4 sentence 2 no. 1 StGB).

For individual professions, the professional laws specify this obligation, for example § 43e BRAO for lawyers and § 62a StBerG for tax advisors. They require, among other things, a contract in text form with a confidentiality obligation.

What does § 203 StGB mean for decommissioned IT?

A decommissioned notebook contains the same secrets as in ongoing operation. According to a widespread view, even passing on a readable data carrier can constitute a disclosure, because the recipient gains the possibility of taking note of the data. Anyone who sells, gives away or hands over old devices unerased to a disposal company that has not been bound to confidentiality therefore incurs a criminal risk. In addition there are the obligations under the GDPR, such as appropriate technical and organizational measures under Art. 32 GDPR.

Obligation	Legal basis	Proof in practice
Bind service providers to confidentiality	§ 203 para. 4 StGB, professional law	Contract or non-disclosure agreement with confidentiality clause
Regulate processing subject to instructions	Art. 28 GDPR	data processing agreement
Render data unreadable before passing on	Art. 32 GDPR	Erasure certificate or certificate of destruction per serial number
Document the path of the devices	Art. 5 para. 2 GDPR	Seamless Chain of custody

Typical mistakes

• Old devices are passed on unerased to employees, associations or schools.
• A disposal company collects devices without a confidentiality obligation being in place.
• Hard drives are only formatted. The data can be recovered with simple means.
• There is no record per device, only a blanket confirmation of a number of units.
• Printers, copiers and dictation devices are forgotten, even though they also contain storage.

If a data carrier containing patient or client data is lost, there may additionally be a Data breach under Art. 33 GDPR, which must be reported within 72 hours.

Practical example: A tax firm replaces 15 workstations

A simplified example shows the process.

1. The firm creates a device list with the serial numbers of all 15 PCs, two network storage devices and one multifunction printer.
2. It concludes a contract in text form with the service provider that obliges it to confidentiality, as well as a data processing agreement.
3. The devices are collected under seal. The handover record states the quantity and seal numbers.
4. At the service provider, all data carriers are erased. Whatever cannot be erased is destroyed.
5. The firm receives an erasure or destruction certificate for each serial number and adds it to its records.

This allows the firm to prove later that it has fulfilled its obligations under professional law, the StGB and the GDPR.

§ 203 StGB at Second IT

Second IT supports persons bound by professional secrecy with services for data secrecy and confidentiality. All employees are bound to data secrecy and confidentiality. On request, Second IT concludes individual non-disclosure agreements (NDAs). The devices arrive in Schwäbisch Hall with our own secure logistics: direct transport without intermediate storage, GPS monitoring and tamper-proof sealing. Processing takes place in areas with access control and video surveillance. Every device is erased with Blancco and receives a digitally signed erasure certificate. Data carriers that cannot be erased are destroyed in-house in accordance with DIN 66399 (up to security level H-5 and E-5). How to dispose of data carriers correctly overall is explained in our guide Disposing of data carriers in GDPR-compliant fashion.

Distinction from related terms

Professional secrecy under § 203 StGB protects secrets that were entrusted to a person in their professional role. Data secrecy, or the duty of confidentiality, by contrast concerns all employees who process personal data. The GDPR protects personal data in general, regardless of profession. A company's trade secrets are governed by the German Trade Secrets Act (GeschGehG). This entry does not replace legal advice. Clarify individual questions with your professional chamber, your legal counsel or your data protection officer.

Frequently asked questions about § 203 StGB

May a medical practice have its old PCs erased by an external service provider?

Yes. Since 2017, § 203 para. 3 StGB has permitted making secrets accessible to participating service providers insofar as this is necessary for their activity. However, the practice must bind the service provider to confidentiality. In addition, a data processing agreement is usually required.

Is formatting a hard drive already sufficient?

No. When formatting, the data usually remains completely intact and can be recovered. For data carriers with professional secrets, you need a secure erasure method with a record per device or physical destruction.

Who is liable if the service provider discloses data?

The service provider itself is liable to prosecution under § 203 para. 4 sentence 1 StGB. The person bound by professional secrecy commits an offense if they have not bound the provider to confidentiality. Under data protection law, the client remains responsible as controller.

Does § 203 StGB also apply to companies without persons bound by professional secrecy?

Only if they work for persons bound by professional secrecy, for example as the IT service provider of a law firm. For other companies, the GDPR and the Trade Secrets Act mainly apply. In practice, the requirements for secure erasure and records are similar.

What penalty is threatened for a violation?

Imprisonment of up to one year or a fine. Anyone who acts for payment or with the intent to enrich themselves or cause harm risks up to two years. The offense is prosecuted only upon complaint.