Germany BDSG and TDDDG: Rules on Top of the GDPR

Germany adds two national laws to the GDPR that change everyday security and privacy decisions: the Federal Data Protection Act (BDSG), which lowers the threshold for appointing a data protection officer and regulates employee data, and the Telecommunications Digital Services Data Protection Act (TDDDG), which governs cookies and any access to users' devices. Both differ from the GDPR baseline in ways that catch out organisations used to other EU countries: a DPO duty that starts at 20 people, an employee data provision that the courts have partly set aside, and a device-access rule that applies whether or not personal data is involved. This guide explains what the two laws require, where case law has moved the ground, and what security and IT teams should change. It is for security, privacy, HR technology and web teams in organisations established in Germany or offering services there. For the GDPR baseline, see the GDPR Compliance Guide for Security Teams.

Key takeaways

A DPO from 20 people. Section 38 BDSG requires a DPO where a controller or processor generally employs at least 20 people permanently engaged in automated processing of personal data, and always where a DPIA is required.
DPOs are hard to dismiss. Section 6(4), applied to private bodies through section 38(2) where designation is mandatory, allows termination only for good cause, and protection continues for one year after the role ends.
Do not rely on section 26(1) sentence 1 alone. After the CJEU's judgment in C-34/21 (30 March 2023), German courts treat the general employee data clause as unusable; cite the GDPR legal bases directly.
Section 25 TDDDG covers every device access. Storing or reading information on a user's device needs consent unless strictly necessary for a service the user expressly requested, and breaches can be fined up to 300,000 euros.
Consent management services are now possible. Section 26 TDDDG and the Einwilligungsverwaltungsverordnung (EinwV) create recognised consent management services registered with the BfDI; using them is voluntary.

How the German rules fit together

The BDSG (2018) uses the GDPR's opening clauses: it adds national rules on DPOs, employee data, special categories, video surveillance and the public sector, and sets out supervision. The TDDDG transposes the ePrivacy Directive's device-access rule and telecoms privacy rules. It was originally the TTDSG, in force from 1 December 2021, and was renamed the TDDDG with effect from 14 May 2024, when the Digitale-Dienste-Gesetz (DDG) replaced the Telemediengesetz; summaries by e-recht24 and CMS both describe the renaming as bringing no substantive change. Supervision is split: the Federal Commissioner for Data Protection and Freedom of Information (BfDI) for federal bodies and telecoms providers, and state supervisory authorities for most private companies, coordinated through the Datenschutzkonferenz (DSK).

Topic	GDPR baseline	German rule	Security and IT impact
Data protection officer	Art. 37: core activities of large-scale monitoring or special category data	Section 38 BDSG: also at 20 or more people permanently engaged in automated processing, or where a DPIA is required, or for commercial data transfer and market research	Most mid-sized companies need a DPO; involve the DPO in security incident and DPIA decisions
DPO protection	Art. 38(3): no dismissal for performing tasks	Section 6(4) via section 38(2), where designation is mandatory: dismissal only for good cause, protected for one year after the role	Choose the DPO carefully; an internal security manager as DPO creates conflict and lasting protection
Employee data	Art. 88 allows more specific national rules	Section 26 BDSG; sentence 1 of 26(1) treated as inapplicable after C-34/21	Monitoring, logging and investigation tools need an Art. 6 legal basis and safeguards
Device access and cookies	ePrivacy Directive Art. 5(3)	Section 25 TDDDG: consent for storing or accessing information, two exceptions	Applies to SDKs, fingerprinting and device telemetry, not only cookies
Consent management	No equivalent	Section 26 TDDDG and EinwV: recognised services registered with the BfDI	Optional integration; a compliant banner is still needed
Video surveillance	General Art. 6 rules	Section 4 BDSG for publicly accessible areas: necessity, signage, prompt deletion	CCTV retention and access controls; see the physical security section below

Data protection officers: section 38 and section 6

Section 38(1) BDSG adds to Article 37(1)(b) and (c) GDPR: a private controller or processor must designate a DPO where it "in der Regel mindestens 20 Personen ständig mit der automatisierten Verarbeitung personenbezogener Daten beschäftigen" (generally employs at least 20 persons permanently engaged in automated processing of personal data). Regardless of headcount, a DPO is required where processing needs a DPIA under Article 35 GDPR, or where personal data is processed commercially for transfer, anonymised transfer, or market or opinion research.

Counting: the test is people permanently engaged in automated processing, not total staff. Most office roles using email and business systems count, so a company of 25 office staff will usually meet it. Record the count and the date in your accountability file.
Protection: where designation is mandatory, section 6(4) applies: removal only by analogy to section 626 of the Civil Code (good cause), no termination of employment except for good cause without notice, and the same protection for one year after the role ends.
Confidentiality: the DPO must keep a data subject's identity confidential unless released, and has the same right to refuse testimony as management for professional reasons; files covered by it cannot be seized.
Conflicts: the CISO or head of IT deciding on processing is a poor choice of DPO. An external DPO avoids both the conflict and the long dismissal protection.

For the role itself, see the Privacy Engineer and DPO Career Guide.

Employee data: section 26 after C-34/21

Section 26 BDSG is Germany's employment data provision. Section 26(1) allows processing necessary for hiring, performing or ending employment, or for employee representation rights, and allows processing to detect criminal offences only where documented concrete indications point to an offence by the employee, the processing is necessary and proportionate, and the employee's interests do not prevail. Section 26(2) says consent is judged against the employee's dependency, can be voluntary where the employee gains an advantage or interests align, must normally be in writing or electronic form, and requires information in text form about the purpose and the right to withdraw. Section 26(8) defines employees widely, including agency workers, trainees, applicants and former employees.

On 30 March 2023 the CJEU held in C-34/21 that a Hessian provision worded like section 26(1) sentence 1 was not a "more specific rule" under Article 88 GDPR because it only repeated the GDPR. Bird & Bird reports that the Federal Labour Court (BAG) has since treated section 26(1) BDSG as not a valid legal basis, most recently in a judgment of 8 May 2025 (8 AZR 209/21), and that in C-65/23 (19 December 2024) the CJEU held that works council agreements cannot legitimise processing that is otherwise inadmissible under the GDPR. DLA Piper's analysis of C-34/21 expected section 26(1) sentence 2 on criminal investigations to remain usable because it is more specific than the GDPR.

Re-paper the legal basis: cite Article 6(1)(b) GDPR (and Article 9(2)(b) for special categories) in privacy notices, records of processing and DPIAs, rather than section 26(1) alone.
Security monitoring of staff: UEBA, DLP, email scanning and endpoint telemetry need a documented legitimate interest or legal obligation, a proportionality assessment and safeguards. Works council agreements remain necessary for co-determination, but they do not cure an unlawful processing. See the Employee Monitoring and Privacy Guide.
Internal investigations: document the concrete indications before targeted analysis of one employee's data, as section 26(1) sentence 2 requires.
Group data sharing: the 2025 BAG judgment awarded damages over a transfer of employee data to a group company's HR system; test group-wide HR and identity platforms against necessity.

Device access and cookies: section 25 TDDDG

Section 25(1) TDDDG allows storing information on an end user's device, or accessing information already stored there, only with consent based on clear and comprehensive information, with information and consent following the GDPR. Section 25(2) has two exceptions: where the sole purpose is transmitting a message over a public telecommunications network, and where the storage or access is strictly necessary for a digital service provider to deliver a service the user has expressly requested.

Not only cookies: the rule covers local storage, SDKs in mobile apps, device fingerprinting that reads device properties, and telemetry agents on consumer devices. It applies whether or not the information is personal data.
Security uses: fraud detection and bot defence scripts that read device data are often argued to be strictly necessary for a requested service. Document the argument per script and keep the data use limited to that purpose; analytics riding on the same script breaks the exception.
Fines: section 28(1) no. 13 makes a breach of section 25(1) sentence 1 an administrative offence with a maximum fine of 300,000 euros under section 28(2). GDPR fines apply separately to any personal data processing that follows.

For implementation detail, see the Cookie and Tracking Technology Compliance Guide and the ePrivacy Directive Guide.

Recognised consent management services

Section 26 TDDDG provides for recognised consent management services (sometimes called PIMS) that store users' consent decisions and pass them to websites. The EinwV sets the requirements: user-friendly and competition-compliant procedures, no economic interest in the consents, independence, a security concept, and recognition by the BfDI, which keeps a public register. CMS reports that the EinwV entered into force on 1 April 2025 and that integration is voluntary for website operators, who still need a compliant banner for users without such a service.

Video surveillance and physical security

Section 4 BDSG covers optical-electronic monitoring of publicly accessible spaces. It is permitted only where necessary for public tasks, exercising domestic authority (Hausrecht) or specified legitimate interests, and where the interests of people filmed do not outweigh those aims. The fact of surveillance and the controller's name and contact details must be recognisable as early as possible, recordings may be kept only while needed for the purpose, and must be deleted without delay afterwards. Camera systems are also IT assets: restrict viewing and export rights, log access, and patch them. Employee video surveillance is a regular enforcement theme across Europe; see the Physical Security Guide for Security Teams.

Rolling out German compliance

Confirm DPO duty: count people permanently engaged in automated processing per legal entity, check the DPIA trigger, and designate and notify the DPO to the competent state authority.
Re-paper employee processing: update records of processing, notices and DPIAs to cite GDPR legal bases for HR, identity and monitoring systems.
Review security monitoring: for each tool that processes employee data, record purpose, legal basis, proportionality and safeguards, and agree it with the works council where co-determination applies. Pilot changes in one department, with the previous configuration kept for rollback.
Inventory device access: list every cookie, SDK, script and agent that stores or reads information on user devices, and classify each as consented or strictly necessary.
Fix consent: block non-essential device access before consent; decide whether to integrate a recognised consent management service.
Tidy CCTV: signage, retention, access rights and logging for every camera system.

A small company just over the 20-person threshold can usually meet these duties with an external DPO, a consent tool configured to block before consent, and a short legitimate interest assessment for its security tools. A large group should hold one German addendum to its privacy framework, with a section 26 review of every HR and monitoring system and a device-access inventory owned by the web and app teams.

Where identity fits

Employee identity data flows through directories, HR systems, IAM and security tools, often across group companies. Each of those flows needs a GDPR legal basis now that section 26(1) sentence 1 cannot carry it alone. Identity analytics that profile individual behaviour, and privileged access recordings, are employee monitoring and should go through the same proportionality review. On the device side, authentication tokens and session cookies set for a login the user requested fall within the strictly necessary exception; marketing identifiers set at the same time do not. See the Identity Data Privacy and Consent Guide.

Detection and measurement

DPO coverage: legal entities over the section 38 threshold with a designated and notified DPO.
Legal basis hygiene: records of processing that still cite section 26(1) sentence 1 as the only basis, trending to zero.
Monitoring tools reviewed: percentage of employee-data security tools with a documented proportionality assessment.
Pre-consent device access: pages and app screens where non-essential storage or reading happens before consent, from regular scans.
CCTV retention: camera systems whose configured retention matches the documented purpose.

Common failure patterns

Counting total staff instead of processing staff, or ignoring the DPIA trigger that requires a DPO regardless of size.
Appointing the head of IT as DPO, creating a conflict of interest and a long dismissal protection.
Relying on section 26(1) or a works council agreement alone for employee monitoring after C-34/21 and C-65/23.
Treating section 25 as a cookie rule, while SDKs, fingerprinting and telemetry read device data without consent.
Bundling analytics into "necessary" security scripts, which defeats the strictly necessary exception.

Framework mapping

German requirement	GDPR	NIST SP 800-53 Rev. 5
Section 38 and section 6 BDSG (DPO)	Art. 37 to 39	PM-19
Section 26 BDSG (employee data)	Art. 6, 9, 88	PT-2, PT-3
Section 25 TDDDG (device access)	Art. 7, ePrivacy Art. 5(3)	PT-4
Section 4 BDSG (video surveillance)	Art. 6, 13	PE-6

Practitioner checklist

Count people permanently engaged in automated processing per entity and record the DPO decision.
Check whether any processing requires a DPIA, which triggers a DPO regardless of size.
Avoid appointing anyone who decides on processing, such as the CISO or head of IT, as DPO.
Replace section 26(1) sentence 1 citations with GDPR Article 6 and 9 legal bases.
Document concrete indications before any targeted investigation of an employee's data.
Run a proportionality review for UEBA, DLP, email scanning and privileged session recording.
Inventory every cookie, SDK, script and agent that touches user devices, and block non-essential ones before consent.
Keep fraud and bot defence scripts separate from analytics so the strictly necessary exception holds.
Set CCTV signage, retention and access controls under section 4 BDSG.

Standards and references

Related NHI Mgmt Group resources: GDPR Compliance Guide for Security Teams · Germany NIS2 Implementation Guide · Germany BSI C5 Guide · Employee Monitoring and Privacy Guide. This guide summarises German data protection law and is not legal advice.

Germany BDSG and TDDDG: national data protection rules on top of GDPR