--- title: "Germany — Controller/Processor Duties | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/germany/controller-processor-duties/ source_html: /jurisdictions/germany/controller-processor-duties/index.html description: "Germany — Controller/Processor Duties: controller_processor_duties Controller/Processor Duties 7 sub-modules 9 claims Green ▾ # Robust, CJEU-tested accountability framework with clear national thresholds and multiple layere" generated_at: 2026-10-25T04:46:50Z content_sha256: 1c75e81229d76de06c74319a3488728ae2ea8001c7a2deb1dadd5210bd012823 generator: "fe-fleet/md-twin@1.0" --- # Germany — Controller/Processor Duties | Data Protection Monitor ### D4Controller/Processor Duties7 sub-modules9 claimsGreen▾# Robust, CJEU-tested accountability framework with clear national thresholds and multiple layered breach-notification regimes; no material gaps identified. Primary framework GDPR Articles 24-39, supplemented by BDSG §§6, 38, 65, 70 and TKG §169 Supervisory authority [BfDI](https://www.bfdi.bund.de/) Traffic-light rationale — Green Robust, CJEU-tested accountability framework with clear national thresholds and multiple layered breach-notification regimes; no material gaps identified. #### Sub-modules (7) #### Accountability And DpiaGreen Art 35 GDPR DPIA duties apply generally; §67(1) BDSG imposes an analogous risk-screening threshold analysis for federal bodies in JI-Directive scope. Claims (1): - §67(1) BDSG imposes an analogous risk-screening threshold-analysis obligation on federal bodies in JI-Directive scope, alongside GDPR Art 35 DPIA duties. #### Dpo RequirementsGreen National 20-person threshold (§38 BDSG) plus GDPR Art 37 material triggers; enhanced DPO dismissal protection upheld by CJEU. Claims (3): - §38 BDSG sets a national DPO-appointment headcount threshold of 20 persons regularly engaged in automated processing. Threshold raised from 10 to 20 by 2019 BDSG amendment. - German DPOs benefit from enhanced statutory dismissal protection beyond the GDPR Art 38(3) baseline. - CJEU (Case C-534/20, Leistritz) upheld Germany's enhanced DPO dismissal protection as compatible with EU law. Single primary anchor; recency_date approximate. #### Ropa RequirementsGreen Art 30 GDPR ROPA duty generally applies; §70 BDSG imposes a stricter ROPA duty with no de-minimis exemption for JI-Directive-scope federal processing. Claims (1): - §70 BDSG imposes a stricter records-of-processing (ROPA) duty for federal-public-body processing in JI-Directive scope, with no de-minimis exemption, compared to GDPR Art 30. #### Joint Controller ArrangementsAmber No DE-specific derogation from Art 26/28 GDPR joint-controller/processor rules was identified in this research pass. Absence provenance: unavailable . Searched: BDSG joint controller Art 26 derogation, BfDI Auftragsverarbeitung Muster. #### Security MeasuresGreen Art 32 GDPR technical/organisational measures apply, including breach-detection capability as a core element. Claims (1): - GDPR Article 32 requires technical and organisational security measures, including breach-detection capability as a core element. #### Breach NotificationGreen 72-hour Art 33 GDPR notification rule plus Art 34 high-risk subject notification; stricter 24-hour sectoral rule for telecom breaches under §169 TKG. Claims (3): - GDPR Article 33 requires controllers to notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it. - GDPR Article 34 requires notification to affected data subjects where a breach is likely to result in a high risk to their rights and freedoms. - §169 TKG imposes a stricter 24-hour breach-notification rule for telecommunications-sector data breaches. Also underpins 5-year telecom breach-log retention duty (see data_localisation). #### Retention And DisposalAmber General GDPR storage-limitation principle applies; telecom breach records must be logged for five years under §169(3) TKG. No further DE-specific general retention statute was identified. Absence provenance: unavailable . Searched: BDSG allgemeine Löschfristen, Aufbewahrungspflicht personenbezogene Daten Deutschland. #### Key findings (3) - — source on file - — source on file - — source on file Category narrative 90 words Germany layers national specifics onto the GDPR accountability regime: BDSG §38 sets a national DPO-appointment headcount threshold (20 persons regularly engaged in automated processing) in addition to the GDPR Art 37 material triggers, and grants DPOs enhanced dismissal protection (upheld as compatible with EU law by the CJEU in Leistritz, C-534/20). Breach notification follows the general 72-hour Art 33 GDPR rule, with a stricter 24-hour sectoral rule for telecom-sector breaches under §169 TKG. Federal-public-body ROPA duties under §70 BDSG (JI-Directive scope) are stricter than the Art 30 GDPR de-minimis threshold. Periodic update · new data 2026-10-18 #### Controller/Processor Duties The Lower Saxony data-protection authority is reported to have recorded 1,245 personal-data-breach notifications in the first half of 2026 alone, a year-on-year increase of 58%, a volume reported already to exceed the authority's full-year 2025 total. The majority of reported cases involved misdirected mailings and accidental disclosures, consistent with a persistent pattern of human-error-driven breach events, though the reporting also notes a rising share attributable to hacking and phishing activity, suggesting a gradual shift in the breach-cause mix toward more deliberate attack vectors alongside the continuing baseline of accidental disclosure. It is important to be precise about what has and has not changed here: the underlying legal test under Articles 33 and 34 GDPR, governing when a breach must be notified to the supervisory authority and, where relevant, to affected data subjects, is unchanged. What this data point reflects is operational volume and pressure on the breach-notification and incident-response functions of controllers operating in or reporting to Lower Saxony, not a change in the substantive legal threshold for notification. The figure is specific to one Land's authority and should not be assumed to be representative of breach-notification volumes nationally without corroborating data from other Länder authorities. #### Outlook Whether the rising hacking-and-phishing share of breach causes reported in Lower Saxony continues, and whether other Länder authorities report comparable year-on-year increases, will be useful indicators of whether this is a genuinely national trend or a Lower-Saxony-specific reporting or enforcement artefact. Controllers should treat the volume increase as an operational signal to review incident-response and breach-detection capacity rather than as evidence of any change to the legal notification threshold itself. 2 earlier distinct update(s) Periodic update · new data 2026-09-28 #### Controller/Processor Duties The BfDI imposed a combined 45 million euro fine on Vodafone GmbH, split across two distinct controller-duty failures. The larger component, 30 million euros, was imposed under Article 32(1) GDPR for authentication-security deficiencies in the combined use of the MeinVodafone customer portal and Vodafone's telephone hotline, a combination that enabled unauthorised third parties to gain access to customer eSIM profiles. The second component, 15 million euros, was imposed under Article 28(1) GDPR for Vodafone's failure to adequately review and monitor partner sales agencies acting on its behalf, a processor-oversight failure distinct from the security-of-processing failure underlying the larger fine. Both components of the fine are directly sourced from the BfDI's own press release and represent the largest BfDI enforcement action on record this cycle. Read together, they identify two separate controller obligations that BfDI is treating as independently enforceable: the security-of-processing obligation under Article 32, which requires technical and organisational measures appropriate to risk, including robust authentication where combined channels (portal plus hotline) create an elevated attack surface; and the processor and agent-oversight obligation under Article 28, which requires a controller to adequately vet and monitor third parties acting on its behalf, including sales agencies rather than only formally-designated data processors in the strict contractual sense. #### Outlook BfDI's planned follow-up remediation review of Vodafone in 2026 is the concrete marker to watch, since it will indicate whether the fine has produced measurable improvements to authentication controls and partner-agency oversight. The scale of this fine and its dual-component structure may also serve as a template other German controllers in sectors with combined-channel authentication risk or extensive third-party sales-agency networks should examine when assessing their own Article 28 and Article 32 exposure. Periodic update · new data 2026-09-13 #### Controller/Processor Duties A significant judicial constraint on the BfDI's practical enforcement capacity landed this cycle. The Bundesverwaltungsgericht dismissed as inadmissible the BfDI's suit to enforce inspection rights over the Bundesnachrichtendienst (case 6 A 2.24, decided 4 March 2026), holding that the BfDI has no enforceable legal position to litigate BND access refusals. Its only recourse against such a refusal is now a non-binding Beanstandung addressed to the Chancellery — a materially weaker enforcement tool than direct judicial enforcement of inspection rights. This is a confirmed, Tier-1-sourced, binding, in-force ruling that narrows the BfDI's practical oversight mechanism against one of Germany's most significant public-sector processors. Set against this narrowing of enforcement reach, the accountability workload facing controllers and processors more broadly is rising sharply: the BfDI recorded 11,824 total inputs (complaints and inquiries) in 2025, approximately 36 percent more than the prior year and over 52 percent more than 2023, with complaint numbers having more than doubled within two years. The confirmed finding here is a growing volume of citizen-facing complaint and inquiry activity that controllers and processors should expect to generate more scrutiny and correspondence, even as the BfDI's enforcement toolkit against the most powerful public-sector processor category has just been narrowed by the courts. #### Outlook The key tension to watch is whether the BfDI's narrowed enforcement position against public-sector processors like the BND translates into any legislative or procedural fix, and whether the sharply rising complaint volume prompts a resourcing response from the BfDI as it also absorbs its new Data Act competence. Evidence 9 Sources and claims (9) - Probable[BfDI](https://www.bfdi.bund.de/SharedDocs/Downloads/DE/Broschueren/INFO6.pdf) — §67(1) BDSG imposes an analogous risk-screening threshold-analysis obligation on federal bodies in JI-Directive scope, alongside GDPR Art 35 DPIA duties.observed 2026-07-29 - Probable[BfDI](https://www.bfdi.bund.de/SharedDocs/Downloads/DE/Broschueren/INFO4.pdf) — §38 BDSG sets a national DPO-appointment headcount threshold of 20 persons regularly engaged in automated processing. Threshold raised from 10 to 20 by 2019 BDSG amendment.observed 2026-07-29 - Probable[BfDI](https://www.bfdi.bund.de/SharedDocs/Downloads/DE/Broschueren/INFO4.pdf) — German DPOs benefit from enhanced statutory dismissal protection beyond the GDPR Art 38(3) baseline.observed 2026-07-29 - Probable[EUR-Lex / CJEU](https://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:62020CJ0534) — CJEU (Case C-534/20, Leistritz) upheld Germany's enhanced DPO dismissal protection as compatible with EU law. Single primary anchor; recency_date approximate.observed 2026-07-29 - Probable[BfDI](https://www.bfdi.bund.de/SharedDocs/Downloads/DE/Muster/Muster_Hinweise_Verfahrensverzeichnis.pdf) — §70 BDSG imposes a stricter records-of-processing (ROPA) duty for federal-public-body processing in JI-Directive scope, with no de-minimis exemption, compared to GDPR Art 30.observed 2026-07-29 - Probable[BfDI](https://www.bfdi.bund.de/DE/Service/Kontakt/Meldung-Datenschutzversto%C3%9F/Info_MeldungDSVerstoss.html) — GDPR Article 32 requires technical and organisational security measures, including breach-detection capability as a core element.observed 2026-07-29 - Probable[BfDI](https://www.bfdi.bund.de/DE/Service/Kontakt/Meldung-Datenschutzversto%C3%9F/Info_MeldungDSVerstoss.html) — GDPR Article 33 requires controllers to notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it.observed 2026-07-29 - Probable[European Data Protection Board](https://www.edpb.europa.eu/system/files/2024-10/edpb_guidelines_202209_personal_data_breach_notification_v2.0_de_0.pdf) — GDPR Article 34 requires notification to affected data subjects where a breach is likely to result in a high risk to their rights and freedoms.observed 2026-07-29 - Probable[BfDI](https://www.bfdi.bund.de/DE/Datenschutz/Themen/Telefon_Internet/InfosFuerTKAnbieterArtikel/DasVerfahrenNachParagraf109A_TKG.html) — §169 TKG imposes a stricter 24-hour breach-notification rule for telecommunications-sector data breaches. Also underpins 5-year telecom breach-log retention duty (see data_localisation).observed 2026-07-29