---
title: "Germany — Lawful Processing & Special Data | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/germany/lawful-processing-and-special-data/
source_html: /jurisdictions/germany/lawful-processing-and-special-data/index.html
description: "Germany — Lawful Processing & Special Data: lawful_processing_and_special_data Lawful Processing & Special Data 4 sub-modules 7 claims Amber ▾ # Core GDPR bases are firmly in force (green), but §26 BDSG's acknowledged n"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 41d776b37a510cc0163304cfd7e63b35d393300156f1e872460cea5274578ef7
generator: "fe-fleet/md-twin@1.0"
---
# Germany — Lawful Processing & Special Data | Data Protection Monitor

### D2Lawful Processing & Special Data4 sub-modules7 claimsAmber▾#

Core GDPR bases are firmly in force (green), but §26 BDSG's acknowledged normative imprecision on special-category employee data and the absence of a dedicated Employee Data Protection Act create interpretive uncertainty, justifying an amber rating for this module overall.

Primary framework GDPR Articles 6-9, as supplemented by BDSG §§22, 26

Supervisory authority [BfDI](https://www.bfdi.bund.de/)

Traffic-light rationale — Amber Core GDPR bases are firmly in force (green), but §26 BDSG's acknowledged normative imprecision on special-category employee data and the absence of a dedicated Employee Data Protection Act create interpretive uncertainty, justifying an amber rating for this module overall.

#### Sub-modules (4)

#### Lawful BasesAmber

Six Art 6(1) GDPR bases apply; §26 BDSG (Art 88 opening clause) governs employment-context processing but is considered too imprecise by BfDI/DSK.

Claims (2):

- GDPR Article 6(1) provides six lawful bases for processing personal data.
- §26 BDSG governs employment-context data processing under the Art 88 GDPR opening clause; criticized by BfDI/DSK as too imprecise, prompting calls for a standalone Employee Data Protection Act. Interpretive uncertainty flagged by DSK; see gaps_register on Employee Data Protection Act status.

#### Consent ThresholdsGreen

Consent must be an unambiguous active affirmative act; digital-consent age fixed at 16 in Germany.

Claims (2):

- Consent under GDPR requires an unambiguous, active affirmative act by the data subject.
- Germany (GDPR Art 8 opening clause) sets digital-consent age at 16.

#### Special CategoriesAmber

Art 9(2)(a) explicit consent required for sensitive data; §26(3) BDSG imposes additional employment-context conditions.

Claims (2):

- GDPR Article 9(2)(a) requires explicit consent for processing special-category (sensitive) data absent another statutory exception.
- §26(3) BDSG imposes additional conditions on processing special-category data in the employment context.

#### Pseudonymisation And AnonymisationGreen

TTDSG §19(2) requires telemedia providers to enable anonymous/pseudonymous use where technically feasible and reasonable.

Claims (1):

- TTDSG §19(2) requires telemedia providers to enable anonymous or pseudonymous use of services where technically feasible and reasonable.

#### Key findings (3)

- — source on file
- — source on file
- — source on file

Category narrative 70 words

Lawful processing follows the six GDPR Art 6(1) bases, with Germany exercising the Art 8 opening clause to set the digital-consent age at 16 and the Art 88 opening clause to enact §26 BDSG for employment-context processing (criticized by BfDI/DSK as too imprecise, prompting calls for a standalone Employee Data Protection Act). Special-category processing requires explicit consent or a statutory exception; TTDSG imposes an ancillary pseudonymisation/anonymous-use obligation on telemedia providers.

Periodic update · new data 2026-10-18

#### Lawful Processing & Special Data

German law continues to treat B2B email marketing more strictly than the presumed-consent model sometimes assumed from a purely commercial perspective. Under Section 7(2) No. 2 of the UWG (Gesetz gegen den unlauteren Wettbewerb), prior express consent is required for email marketing regardless of whether the recipient is a consumer or a business. This is a materially stricter position than might be assumed by analogy to the presumed-consent rule that does apply to business recipients for telephone marketing under Section 7(2) No. 1 of the same statute; the two marketing channels are treated differently under German law, and the telephone-marketing presumption does not extend to email.

A relevant interpretive development affecting the soft opt-in exception comes from the Court of Justice of the European Union's ruling in C-654/23 (Inteligo Media), understood to have been handed down around 13 November 2025. The ruling is understood to hold that a free account can count as obtaining a customer's contact details "in the context of the sale of a product or service" for soft-opt-in purposes, where the ostensibly free service is in fact indirectly paid for through an associated paid-subscription business model. This interpretation is binding on Germany as an EU member state, though the precise pinpoint paragraph of the judgment has not been independently verified against the court's own text this cycle. For German controllers relying on the soft opt-in under the implementing provisions of the ePrivacy framework, this ruling is relevant to any freemium or indirectly-monetised service model where contact details are collected through a nominally free tier.

#### Outlook

Controllers operating freemium or tiered-subscription services in Germany should consider how the Inteligo Media interpretation of "in the context of the sale of a service" applies to their own soft opt-in reliance, particularly where a free tier functions as a lead-generation mechanism for a paid tier. The exact scope of the ruling, including whether German courts or the data-protection authorities issue any domestic guidance applying it, was not established this cycle and is worth monitoring.

Evidence 7

Sources and claims (7)
- Probable[BfDI](https://www.bfdi.bund.de/DE/BfDI/Inhalte/Datenschutzpfad/DSGVO.html) — GDPR Article 6(1) provides six lawful bases for processing personal data.observed 2026-07-29
- Probable[DSK](https://www.bfdi.bund.de/SharedDocs/Downloads/DE/DSK/DSKEntschliessungen/DSK_20220429-Besch%C3%A4ftigtendatenschutz.pdf) — §26 BDSG governs employment-context data processing under the Art 88 GDPR opening clause; criticized by BfDI/DSK as too imprecise, prompting calls for a standalone Employee Data Protection Act. Interpretive uncertainty flagged by DSK; see gaps_register on Employee Data Protection Act status.observed 2026-07-29
- Probable[BfDI](https://www.bfdi.bund.de/EN/Buerger/Inhalte/Allgemein/Datenschutz/Einwilligung.html) — Consent under GDPR requires an unambiguous, active affirmative act by the data subject.observed 2026-07-29
- Probable[BfDI](https://www.bfdi.bund.de/EN/Buerger/Inhalte/Allgemein/Datenschutz/Einwilligung.html) — Germany (GDPR Art 8 opening clause) sets digital-consent age at 16.observed 2026-07-29
- Probable[BfDI](https://www.bfdi.bund.de/DE/BfDI/Inhalte/Datenschutzpfad/DSGVO.html) — GDPR Article 9(2)(a) requires explicit consent for processing special-category (sensitive) data absent another statutory exception.observed 2026-07-29
- Probable[BfDI](https://www.bfdi.bund.de/DE/Buerger/Inhalte/Arbeit-Besch%C3%A4ftigung/Besch%C3%A4ftigtendatenschutz/FAQ_Besch%C3%A4ftigtendatenschutz.html) — §26(3) BDSG imposes additional conditions on processing special-category data in the employment context.observed 2026-07-29
- Probable[OneTrust DataGuidance](https://www.dataguidance.com/opinion/germany-faqs-what-does-ttdsg-mean-you) — TTDSG §19(2) requires telemedia providers to enable anonymous or pseudonymous use of services where technically feasible and reasonable.observed 2026-07-29