GDPR Variations in Six EU Member States: age of consent, employee data, DPO and criminal data rules

The GDPR is one regulation, but a multinational that runs one privacy and security programme across the EU will still break national rules, because the regulation leaves dozens of choices to Member States. Opening clauses let each country set its own age of digital consent, add Data Protection Officer triggers, write employee data rules, decide who may process criminal records and limit use of national identification numbers. This guide compares six Member States, listed alphabetically (France, Germany, Ireland, Italy, the Netherlands and Spain), on the rules that most often change how identity, HR, logging and security tooling must be configured. It is written for security, privacy and IAM teams who build controls once and deploy them in several countries.

Source note: the Irish, French, Spanish and Italian age rules were checked against statute text or the national authority. The official Italian and Dutch texts could not be accessed while this guide was written, so parts of those rows, and the summaries of national implementing acts, rely on secondary sources: DLA Piper's Data Protection Laws of the World, leggeinchiaro.it (which reproduces the Italian article text) and Studio Cataldi. Each obligation below names its source. Confirm against the official text before relying on it.

Key takeaways

• Age of consent varies from 14 to 16 in the six countries here: 14 in Italy and Spain, 15 in France, 16 in Ireland and the Netherlands. Age gates and parental consent flows need per-country settings.
• DPO duties go beyond Article 37. Germany requires a DPO from 20 people regularly processing personal data by automated means, and Spain lists sixteen categories of entity that must always appoint one.
• Employee data is the most fragmented area. Spain writes workplace digital rights into statute, Italy's Garante limits email metadata retention, and Germany's section 26 BDSG has been weakened by the CJEU ruling in C-34/21.
• Criminal records checks need a national legal basis. Article 10 GDPR only allows processing under official authority or where Union or Member State law authorises it, so background screening rules differ by country.
• National ID numbers need their own rule. The Netherlands allows a national identification number only where a law explicitly permits it, and France requires a decree or order for the social security number (NIR).

Which GDPR clauses create national variation

The GDPR text itself sets the room for variation. The table lists the clauses this guide covers.

For the regulation-wide obligations (Article 32, breach notification, processors, transfers) see the GDPR Compliance Guide for Security Teams. This guide covers only the national layer.

Age of digital consent by country

Article 8 applies when consent is the lawful basis for offering an information society service directly to a child. Below the national age, consent must be given or authorised by the holder of parental responsibility, and the European Commission says controllers must make a reasonable effort, taking available technology into account, to verify that this has happened.

• Ireland's wider definition of child: DLA Piper notes that the Irish Act defines child more widely than the Article 8 age, which matters for DPIAs, and that section 33 gives children a specific erasure right for data collected through information society services.
• France on information: where data is collected from a child under 15, Article 13 information must be given in clear, accessible language (DLA Piper).
• Italy on verification: the commentary on leggeinchiaro.it says a simple self-declaration of age is not enough evidence of parental consent; treat this as commentary, not statute.

Design consequence: store the user's country of residence and apply the age threshold from configuration, not code. See the COPPA and Children's Privacy Guide for age assurance methods.

DPO requirements beyond Article 37

For a group with entities in several countries, appoint against the strictest applicable rule and keep a register of which entity each DPO covers. See the Privacy Engineer and DPO Career Guide for the role itself.

Employee data and workplace monitoring

Article 88 allows national law or collective agreements to set more specific rules for employment data. These are the rules that most often constrain DLP, UEBA, endpoint telemetry, email retention and location tracking.

• France: DLA Piper's France entry does not summarise employee data rules; take advice before deploying monitoring and read the France Data Protection and CNIL guide.
• Germany: after the CJEU ruled a comparable state-law employee provision invalid (C-34/21), DLA Piper reports it is widely assumed that parts of section 26 BDSG are also invalid, and employers should rely on Article 6(1)(b) or 9(2)(b) GDPR. Provisions likely to remain valid include processing to detect crimes with documented suspicion (section 26(1) sentence 2) and processing under a works council agreement that meets Article 88(2) (section 26(4)). See the Germany BDSG and TDDDG guide.
• Ireland: no standalone employee data regime in DLA Piper's summary; requiring an employee or candidate to make a subject access request is a criminal offence.
• Italy: under 2024 Garante guidelines, as reported by DLA Piper, employers may keep workplace email metadata only for a short default period unless a documented need exists (confirm the period in the Garante guidelines); longer retention needs a trade union agreement or Labour Office authorisation plus an updated notice, DPIA and legitimate interest assessment. Law 193/2023 limits questions about past oncological disease.
• Netherlands: DLA Piper's summary does not cover employee or works council rules; check national labour law before deploying monitoring.
• Spain: the LOPDGDD sets workplace digital rights in statute. Article 87: employers may access employer-provided devices only to check compliance with work obligations and protect device integrity, must set usage criteria with worker representatives and inform staff. Article 88: a right to digital disconnection and an internal policy. Article 89: prior express information before camera monitoring, and no recording in rest areas such as changing rooms, toilets and canteens; sound recording only where security risks are relevant. Article 90: prior information before geolocation monitoring. Article 91: collective agreements may add guarantees.

For monitoring design in general see the Employee Monitoring and Privacy Guide.

Criminal records, special categories and national ID numbers

Practical effect for identity teams: a single global background screening policy, biometric door access or fingerprint time clock, or use of a national ID number as a user key will not be lawful everywhere. See the Biometrics Guide.

Decision guidance

• Strictest-rule baseline or per-country configuration: a single strictest baseline (for example, age 16 everywhere, DPO for every entity) is simpler and safe, but adds friction for users and cost. Per-country configuration fits better but needs a maintained rules table and testing for each country.
• Small organisations in one or two countries: read the national act or the regulator's guidance directly and take local advice; the comparison above is a starting map.
• Large groups: keep a national variations register owned by privacy, with a named contact per country, and make security tooling read country settings from it.
• Monitoring tools: treat every new monitoring capability as needing a country check (works council, collective agreement or statutory notice) before switch-on.

How to implement

1. Map entities and users to countries: list legal entities, employee locations and customer markets. Variations follow the establishment and the people affected.
2. Build a variations register: one row per country and clause (Articles 8, 9(4), 10, 37(4), 87, 88), with source, date checked and owner. Start from the tables above and confirm against the official text.
3. Externalise settings: put age thresholds, retention limits (such as Italian email metadata) and notice templates in configuration keyed by country.
4. Gate monitoring changes: require a country sign-off and a DPIA before enabling DLP content inspection, UEBA, geolocation or camera analytics in a new country. See the DPIA Guide.
5. Pilot in one country: enable the change for one entity, confirm notices, works council steps and logging behaviour, then extend.
6. Roll back cleanly: if a country rule is found to block a setting, disable it for that country through configuration, delete data collected outside the rule, and record the decision.
7. Review on change: recheck the register when a national act is amended, a court ruling lands (as C-34/21 did) or a regulator issues guidance.

Detection and measurement

• Register coverage: share of countries of operation with a complete, dated variations register row for each clause.
• Configuration drift: number of systems applying a hard-coded age or retention value rather than the country setting.
• Monitoring approvals: share of monitoring tools enabled per country with a recorded country sign-off and DPIA.
• Retention compliance: mailbox and log stores in Italy holding email metadata beyond the documented limit.
• DPO coverage: entities meeting a national DPO trigger with a registered DPO.

Framework mapping

This mapping is NHI Mgmt Group's alignment by subject.

Common failure patterns

• One age gate for the EU: a single threshold of 13 or 16 is either unlawful in some countries or needlessly blocks users in others.
• Counting DPO need only by Article 37: German and Spanish entities can need a DPO even when the GDPR tests are not met.
• Global monitoring switch-on: enabling content inspection or location tracking everywhere at once, without works council, collective agreement or statutory notice steps.
• Relying on section 26 BDSG after C-34/21: continuing to cite a basis that the CJEU ruling has put in doubt.
• National ID as a system key: using a national number as a user or customer identifier where national law limits it to specific purposes.
• Stale register: no date checked and no owner, so amendments and court rulings go unnoticed.

Practitioner checklist

• List every country where you have an entity, staff or targeted customers.
• Create a dated variations register for Articles 8, 9(4), 10, 37(4), 87 and 88 per country, with sources.
• Move age thresholds and retention limits into country configuration.
• Check German and Spanish entities against national DPO triggers and register DPOs where needed.
• Require country sign-off and a DPIA before enabling any staff monitoring capability.
• Confirm a national legal basis before running criminal records checks.
• Stop using national ID numbers as identifiers unless a national law permits that purpose.
• Recheck the register after amendments, court rulings and regulator guidance.

Standards and references

• EUR-Lex: Regulation (EU) 2016/679, General Data Protection Regulation
• Irish Statute Book: Data Protection Act 2018, section 31
• BOE: Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales
• CNIL: Recommandation 4, consentement d'un parent pour les mineurs de moins de 15 ans
• European Commission: Are there any specific safeguards for data about children?
• DLA Piper: Data Protection Laws of the World
• Leggeinchiaro: Articolo 2-quinquies Codice privacy
• Studio Cataldi: Consenso privacy sui social valido da 14 anni in su

Related NHI Mgmt Group resources: Ireland Data Protection Law · Italy Data Protection Law · Netherlands Data Protection Law · Spain Data Protection Law · GDPR Compliance Checklist. This guide summarises national GDPR implementing rules in six Member States and is not legal advice.