2026 has brought several changes to German data protection law — some already in force, some about to apply and some still under discussion. This update summarises the most important ones.
1. New Section 37a BDSG on Scoring — From 20 November 2026
The Act implementing the EU Consumer Credit Directive (EU) 2023/2225 of 12 May 2026 (BGBl. 2026 I No. 139) amends the Federal Data Protection Act (BDSG). It deletes the old Section 31 and inserts a new Section 37a on scoring, which applies from 20 November 2026. The rules respond to the CJEU's SCHUFA judgment and apply when probability values are used to predict a person's behaviour for contract decisions or to assess creditworthiness:
- Prohibited data: special categories of personal data, age, gender, name, social media data, payment information from bank accounts and address data may not be used, and scores may not concern minors
- Method: the data must be demonstrably relevant according to a scientifically recognised statistical method, and the values may not be used for other purposes
- Transparency: on request, controllers must explain which data and criteria were used, how they were weighted and who received the score; this information must be kept for one year
- Human review: individuals can contest a score-based decision, state their position and have it reviewed by a person
The law also revises Section 30 BDSG on consumer credit databases and adds new administrative fines. Banks, lenders, credit agencies, e-commerce businesses offering purchase on account and telecoms providers should review their scoring now.
2. Data Act Supervision: New Role for the BfDI
The EU Data Act has applied since 12 September 2025. Germany's implementing act (DADG) entered into force on 30 May 2026. The Federal Network Agency is the central authority for the Data Act, while the Federal Commissioner for Data Protection (BfDI) supervises it where personal data is involved. Manufacturers of connected products and providers of related services must give users access to the data generated — and where that data is personal, the GDPR and the Data Act apply side by side.
3. The BDSG Reform Debate
- DSK and national one-stop shop: a Bundesrat bill (Bundestag printed paper 21/7732 of 26 August 2026) proposes giving the Data Protection Conference (DSK) a legal basis for binding majority decisions and a lead supervisory authority for groups of companies and cross-state research projects.
- DPO threshold: abolishing or raising the national obligation to appoint a data protection officer (Section 38 BDSG) has been announced politically, but has not been enacted. The current rule still applies.
4. EU Developments to Watch
- GDPR Procedural Regulation (EU) 2025/2518: harmonised rules for cross-border complaints and investigations, applying from 2 April 2027
- Digital Omnibus: the proposed GDPR and cookie changes have stalled — as of October 2026 the Council has no negotiating mandate, so current rules still apply
- EDPB coordinated enforcement 2026: supervisory authorities across Europe are checking compliance with transparency and information obligations (Articles 12–14 GDPR)
Your Checklist
- Review scoring models against Section 37a BDSG before 20 November 2026
- Check Data Act obligations for connected products and services
- Review your privacy notices in view of the coordinated transparency checks
- Keep your DPO appointment until the law actually changes
How ResGuard Can Help
With the ResGuard Data Protection Manager you document processing activities, DPIAs and privacy notices centrally, and our external DPO service supports you with the new requirements.
This article provides general information as of 20 October 2026 and does not constitute legal advice. Sources: BGBl. 2026 I No. 139, BfDI press release 7/2026, Bundestag printed paper 21/7732, Regulation (EU) 2025/2518 and published commentary.