Your Jurisdiction at a Glance — Germany
GDPR + Federal Data Protection Act (BDSG)
Authority: 16 state data protection authorities supervise companies; the Federal Commissioner (BfDI) supervises federal bodies, telecoms and postal services
- Data Protection Officer mandatory if at least 20 people regularly process personal data automatically, or for high-risk processing (§ 38 BDSG)
- Additional rules for employee data (§ 26 BDSG) and works council agreements
- Data breach notification to the authority within 72 hours (Art. 33 GDPR)
- Records of processing activities (Art. 30 GDPR)
- Task 2 of this workshop: document Germany in the data protection scope document, together with sector rules and other countries you operate in
- Workshop 2: governance, roles and the data protection officer
- Workshop 3: records of processing activities
- Workshop 8 and 9: risk assessment and security measures
- Workshop 10: vendors, processors and international transfers
- Workshop 11: data breaches and notification deadlines