Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Germany applies GDPR alongside the national BDSG, but uniquely splits GDPR enforcement across 17 separate supervisory authorities (16 state DPAs plus the federal BfDI) rather than one national regulator. NIS2 is now fully in force via the NIS2UmsuCG, covering roughly 29,500 entities with no transition period.
Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.
EU-wide regulation on personal data processing, directly applicable in Germany without transposition.
SourceGermany's national data protection act, which supplements GDPR with national derogations (e.g. employee data processing, a DPO appointment threshold lower than the GDPR default). It does not replace GDPR's core rules.
SourceGermany's NIS2 transposition act, overhauling the Federal Cybersecurity Act (BSIG). In force since 6 December 2025 with no transition period; imposes registration, incident-reporting, and risk-management duties on roughly 29,500 entities.
Source72 hours
GDPR Article 33 applies uniformly: notify the competent supervisory authority without undue delay, and where feasible within 72 hours of becoming aware of the breach. In Germany, which authority is 'competent' depends on where the controller is established, usually the relevant state (Land) DPA, or the BfDI for federal bodies and telecoms providers. This fragmentation is a genuine practical complication for multi-state German operations.
Notify: Relevant state DPA (or BfDI for federal bodies/telecoms)
SourcePublished legal maximums, not a personalized estimate, not legal advice.
GDPR Article 83(5)
Up to €20,000,000 or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher
SourceBSIG §65 (NIS2UmsuCG)
Up to €10,000,000 or 2% of worldwide annual turnover for critical/essential entities; up to €7,000,000 or 1.4% for important entities
Figures corroborated by legal-tracker sources summarizing §65 BSIG; not verified directly against the consolidated statute text.
SourceApplicable , as of 2026-09-08
Fully transposed and in force. The NIS2UmsuCG entered into force on 6 December 2025, amending the BSIG with no transition period. Registration, incident-reporting, and risk-management duties apply immediately to roughly 29,500 in-scope entities across 18 sectors.
SourceFederal Commissioner for Data Protection and Freedom of Information, plus 16 state-level data protection authorities with primary jurisdiction over private-sector GDPR enforcement(BfDI)
Visit authority siteUnder GDPR Article 33, notify the state (Land) data protection authority where your organization is established within 72 hours where feasible. Germany does not have one central GDPR regulator for the private sector, you must identify the correct one of the 16 state DPAs (or the BfDI if you're a federal body or telecoms provider).
No. The BSI (Federal Office for Information Security) is Germany's technical cybersecurity authority and now the competent authority for NIS2/BSIG matters, but it does not enforce GDPR. GDPR supervision sits with the BfDI (federal bodies) and the 16 state DPAs (everyone else).
Yes. Unlike most other EU member states, Germany's NIS2 transposition (the NIS2UmsuCG) is fully in force as of 6 December 2025, with no transition period for registration, incident reporting, or risk-management obligations.
Talk to us about scoping an engagement around your specific regulatory context.
