Jurisdiction selected: Germany — GDPR + Federal Data Protection Act (BDSG)
Key Concept 1 — Personal Data
Personal data is any information that relates to an identified or identifiable natural person. The definition is deliberately broad, and it is the same idea in almost every data protection law.
Key Concept 2 — Sensitive Data
Sensitive data (also called special categories of personal data) can lead to discrimination, exclusion or other serious harm. The categories differ between laws, so always check your local list.
What this means in practice: stricter conditions such as explicit or written consent, stronger security, access only for those who need it, and in many laws a risk assessment before you start.
Special categories of personal data (Art. 9 GDPR). Processing is prohibited unless one of the listed exceptions applies, e.g. explicit consent. Criminal convictions and offences are protected separately (Art. 10 GDPR).
Key Concept 3 — Processing and Roles
Processing covers the whole lifecycle: collecting, recording, storing, using, sharing, changing and deleting data, whether on paper or in IT systems. Every processing activity has clear roles.
The GDPR applies to organisations established in the EU and to organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour. It protects natural persons only.
Key Concept 4 — The Core Principles
The names vary from law to law, but the ideas behind them are almost universal. The following workshops turn each principle into concrete measures.
Principle in Focus — Lawfulness
Lawfulness means that every processing activity needs a legal basis or a justification. Laws differ most in this point: some are built on consent, others offer several equal legal bases.
Valid consent is freely given, specific, informed and unambiguous — and it can be withdrawn at any time. Pre-ticked boxes and consent hidden in terms and conditions do not count.
Six legal bases (Art. 6 GDPR): consent, performance of a contract, legal obligation, vital interests, public task and legitimate interests. Consent is only one of them and is often not the best choice, e.g. in employment relationships.
Key Concept 5 — Data Transfers
Personal data rarely stay inside one system: they go to service providers, group companies, partners and authorities, and very often to servers abroad. Each of these flows has its own rules.
Easy to overlook: remote access from abroad (e.g. support teams or a parent company) and cloud services hosted outside the country count as transfers, too.
Within the EU/EEA, data flow freely. Transfers to other countries need an adequacy decision of the European Commission (e.g. UK, Switzerland, Japan, or US companies certified under the EU-US Data Privacy Framework), appropriate safeguards such as standard contractual clauses (SCCs) or binding corporate rules (Art. 46 GDPR), or, for occasional transfers only, an exception such as explicit consent (Art. 49 GDPR). With SCCs, a transfer impact assessment is expected. Processors need a contract under Art. 28 GDPR.
Key Concept 6 — Consequences of Non-Compliance
Most enforcement cases start with something avoidable: a security gap, a missing legal basis, an unanswered request from a customer or a complaint from an employee.
Supervisory authority: 16 state data protection authorities supervise companies; the Federal Commissioner (BfDI) supervises federal bodies, telecoms and postal services
Your Jurisdiction at a Glance — Germany
Authority: 16 state data protection authorities supervise companies; the Federal Commissioner (BfDI) supervises federal bodies, telecoms and postal services
Check Your Understanding and Next Steps
Expected result of Task 1: all project team members understand the key data protection terms and principles that the following workshops build on.