--- title: "Germany — Regulator & Framework | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/germany/regulator-and-framework/ source_html: /jurisdictions/germany/regulator-and-framework/index.html description: "Germany — Regulator & Framework: regulator_and_framework Regulator & Framework 5 sub-modules 9 claims Green ▾ # Comprehensive, mature, directly-applicable EU omnibus regime with a stable national implementing act;" generated_at: 2026-10-25T04:46:50Z content_sha256: 87516d2e178439cbe3c443b30b9a9bff7d1e91d78fc854ece31b8631bcd09683 generator: "fe-fleet/md-twin@1.0" --- # Germany — Regulator & Framework | Data Protection Monitor ### D1Regulator & Framework5 sub-modules9 claimsGreen▾# Comprehensive, mature, directly-applicable EU omnibus regime with a stable national implementing act; only amber-adjacent risk is the ongoing BfDI leadership transition and EU Digital Omnibus reform uncertainty. Primary framework Regulation (EU) 2016/679 (GDPR) as implemented and supplemented by the Bundesdatenschutzgesetz (BDSG-neu) Supervisory authority [Bundesbeauftragter für den Datenschutz und die Informationsfreiheit (BfDI)](https://www.bfdi.bund.de/) Traffic-light rationale — Green Comprehensive, mature, directly-applicable EU omnibus regime with a stable national implementing act; only amber-adjacent risk is the ongoing BfDI leadership transition and EU Digital Omnibus reform uncertainty. #### Sub-modules (5) #### Regulator And AuthorityGreen BfDI supervises federal public bodies and federally-regulated private-sector entities (post, telecoms); 17 Land DPAs supervise private-sector and Land-level public bodies. Claims (4): - BfDI supervises federal public bodies and federally-regulated private-sector entities (post and telecoms sectors). Core supervisory-competence allocation. - 17 Land data protection authorities supervise private-sector processing and Land-level public bodies (Bavaria splits public/private-sector oversight). Federated supervisory structure. - BfDI requires: Prof. Dr. Moritz Hennemann took office as Federal Commissioner for Data Protection and Freedom of Information on 1 October 2026, succeeding Prof. Dr. Louisa Specht-Riemenschneider, after election by the Bundestag (June 2026) and appointment by Federal President Frank-Walter Steinmeier (29 September 2026). - BfDI (Hennemann priorities) proposes: Commentary frames Hennemann's priorities as including a planned reform of Germany's data-protection supervisory structure consolidating the federal/Laender 17-body system, and a prospective 'Data Code'; neither has produced enacted legislative text as of this cycle. #### Act And InstrumentsGreen BDSG-neu is the national GDPR implementing act; TTDSG is lex specialis for telecom/telemedia and cookies. Claims (2): - Bundesdatenschutzgesetz (BDSG-neu) supplements the GDPR as a subsidiary national implementing act, applying only where the GDPR permits derogation or leaves gaps. - TTDSG (now TDDDG) functions as lex specialis for telecom/telemedia and cookie/tracking consent matters. TTDSG renamed TDDDG following Digital Services Act adaptation. #### Material ScopeGreen GDPR Art 2 material scope covers wholly/partly automated processing and structured manual filing systems, directly applicable in Germany. Claims (1): - GDPR Article 2 defines material scope covering wholly/partly automated processing and structured manual filing systems, directly applicable in Germany. #### Territorial ScopeGreen GDPR Art 3(2) extends to non-EU controllers targeting or monitoring individuals in Germany/the EU. Claims (1): - GDPR Article 3(2) extends territorial scope to non-EU controllers targeting or monitoring individuals in Germany/the EU. #### Regulator Registration And FilingGreen DPO contact details for federally-supervised entities must be filed with BfDI via a dedicated notification form/portal. Claims (1): - Federally-supervised entities must file DPO contact details with BfDI via a dedicated notification form/portal. #### Key findings (3) - — source on file - — source on file - — source on file Category narrative 104 words Germany applies the GDPR directly, supplemented by the federal Bundesdatenschutzgesetz (BDSG-neu) which is subsidiary and applies only where the GDPR permits national derogation or leaves gaps. Supervision is federated: the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) supervises federal public bodies and certain federally-regulated private sectors (post, telecoms), while 17 Land-level authorities (16 Länder, with Bavaria splitting public/private-sector oversight) supervise private-sector and Land public-sector processing. A leadership transition is underway: Prof. Dr. Moritz Hennemann has been elected by the Bundestag as incoming BfDI, succeeding Prof. Dr. Louisa Specht-Riemenschneider, who remains in office in a transitional capacity until 30 September 2026 for health reasons. Periodic update · new data 2026-10-18 #### Regulator & Framework Germany's data-protection supervisory architecture remains federated: the BfDI, the federal commissioner, does not supervise private-sector GDPR compliance at national level, and each of the sixteen Länder maintains its own data-protection authority for private-sector processing within its territory. This structural fact is unchanged and stands as confirmed background against which this cycle's development sits. The material development this cycle is institutional rather than within the core GDPR supervisory structure itself: the KI-MIG, Germany's implementing act for the EU AI Regulation, was promulgated in the Federal Law Gazette (BGBl. 2026 I Nr. 233) on 28 July 2026 and entered into force the following day, 29 July 2026. The KI-MIG names the Bundesnetzagentur as the central AI market-surveillance and complaints authority for compliance with Regulation (EU) 2024/1689, except in areas where a sectoral regulator already has competence. This creates a second major German data-and-technology regulator operating alongside the federated data-protection authority structure, with its own statutory mandate specific to AI systems rather than personal data processing generally, though the two regimes will frequently overlap in practice given that much high-risk AI activity involves personal data processing. The practical significance of this development for the data-protection landscape is that controllers and processors operating AI systems in Germany now face two potentially overlapping supervisory touchpoints: their relevant Land data-protection authority for GDPR compliance, and the Bundesnetzagentur for AI Act compliance specifically. How these two supervisory tracks will coordinate in practice, including whether the Bundesnetzagentur and the Land DPAs have agreed any formal cooperation mechanism, was not established this cycle. #### Outlook The near-term matter to watch is how the Bundesnetzagentur's new AI market-surveillance mandate interacts in practice with the existing Land-level data-protection authority structure, particularly for AI systems that process personal data and therefore sit at the intersection of both regimes. Any formal coordination guidance or memorandum between the Bundesnetzagentur and the Land DPAs, or the Datenschutzkonferenz more broadly, would be a significant marker of how this dual-authority structure is intended to function. 3 earlier distinct update(s) Periodic update · new data 2026-10-04 #### Regulator & Framework Germany's federal data-protection supervisory authority has completed a leadership transition. Prof. Dr. Moritz Hennemann took office as Federal Commissioner for Data Protection and Freedom of Information on 1 October 2026, succeeding Prof. Dr. Louisa Specht-Riemenschneider. The succession followed election by the Bundestag in June 2026 and formal appointment by Federal President Frank-Walter Steinmeier on 29 September 2026. This sequence, election followed by presidential appointment, is the established constitutional procedure for filling the role, and the transition itself is confirmed by the BfDI's own official announcement, corroborated by independent third-party reporting. Beyond the confirmed fact of the succession, industry-body commentary has begun to frame expectations for Hennemann's tenure. Reported anticipated priorities include a reform of Germany's data-protection supervisory structure, which today spans the federal BfDI alongside sixteen separate Land-level data-protection authorities, a fragmented arrangement that has drawn longstanding commentary about coordination costs and inconsistent enforcement approaches across German states. Commentary also anticipates a prospective consolidated data-protection code, sometimes referred to as a Datengesetzbuch, intended to bring together currently scattered sectoral and general data-protection provisions. Neither the supervisory-structure reform nor the prospective data code has produced enacted legislative text, a published government bill, or even a formal consultation document as of this cycle; both remain at the level of informed anticipation from an industry association rather than confirmed regulatory developments, and should be read with that caveat attached. It is worth being precise about what is and is not established here. The institutional fact of Hennemann's appointment is confirmed at a high confidence level, directly sourced from the regulator's own publication. The forward-looking policy agenda attributed to him is, by contrast, sourced from a single industry trade-association commentary piece reacting to the appointment, and carries no confirmation from the BfDI itself, from the federal government, or from any legislative body that such reforms are actually planned, scheduled, or drafted. Readers should not treat the reform agenda as though it were an announced government policy; it is, at most, an informed expectation from a stakeholder group. The broader institutional context for Germany's data-protection framework remains otherwise unchanged this cycle. The division of competences between the Bundesnetzagentur and the BfDI under the Digital Services Act-adjacent national implementing framework, established in a prior cycle, continues to apply, though it was not independently re-verified against primary text this cycle and is not itself new information for this reporting period. #### Outlook The clearest near-term indicator to watch is whether any of the reform priorities attributed to Hennemann by industry commentary, consolidation of the federal/Laender supervisory structure or the prospective data code, advance to the stage of a published government position, draft bill, or formal consultation. Until one of those concrete steps occurs, the existing seventeen-body supervisory structure remains the operative institutional arrangement, and the reform agenda should be treated as an open question rather than a pending change. The appointment itself is now a settled fact and requires no further monitoring beyond observing how the new Commissioner's early public statements, if any, begin to confirm or depart from the priorities industry commentary has attributed to him. Periodic update · new data 2026-09-28 #### Regulator & Framework Germany's data-protection enforcement remains divided across 17 independent supervisory authorities: the federal BfDI and 16 Land-level data protection authorities, coordinated by the non-binding Datenschutzkonferenz (DSK). This structural feature of the German system is unchanged this cycle, but it now sits alongside a newly-created cross-cutting supervisory allocation under the German Data Act Implementation Act (DADG), which entered into force on 30 May 2026. Under the DADG, the Federal Network Agency (Bundesnetzagentur) becomes the central supervisory and enforcement authority for the EU Data Act, while the BfDI retains its existing responsibility for personal-data processing by non-public bodies under the GDPR. The practical significance of the DADG's entry into force is that it introduces a second federal-level regulator into Germany's data-governance landscape without altering the existing 17-body GDPR structure: the Bundesnetzagentur's Data Act mandate and the BfDI's GDPR mandate are understood to be distinct in scope, with the Bundesnetzagentur handling Data Act matters and the BfDI continuing its narrower personal-data role. Where the boundary between these two mandates will fall in practice, particularly for data-sharing arrangements that touch both personal data and the broader data-access provisions the Data Act addresses, has not yet been tested and remains to be seen as the DADG's practical application develops. #### Outlook The practical division of labour between the Bundesnetzagentur and the BfDI under the newly-in-force DADG is the primary item to watch, since the boundary between Data Act supervision and GDPR personal-data supervision has not yet been tested in a live case. Any early guidance or joint statement from the two authorities clarifying their respective jurisdictions would be the next material development in this area. Periodic update · new data 2026-09-13 #### Regulator & Framework Germany's federal data-protection authority undergoes a confirmed leadership transition this cycle. Prof. Dr. Louisa Specht-Riemenschneider announced her resignation as BfDI for health reasons, remaining in office through 30 September 2026, and the Bundestag has elected Prof. Dr. Moritz Hennemann as her successor. This transition coincides with a material expansion of the BfDI's remit: under the DADG, the BfDI has supervised the Data Act's personal-data aspects for businesses and federal public bodies since the law entered into force on 30 May 2026, with the Bundesnetzagentur serving as the Data Act's general central supervisory and enforcement authority. This is a confirmed, Tier-1-sourced, binding, in-force competence grant rather than a proposal. The combination of a change in leadership and a substantively new area of statutory competence makes this a material-change cycle for the regulator-and-framework module specifically. The dual-regulator model — BfDI for personal-data aspects, Bundesnetzagentur for the Data Act generally — is a structural feature that will define how German Data Act enforcement operates going forward, distinct from Germany's prior single-authority approach to data-protection matters generally. #### Outlook Watch the formal handover date and Hennemann's early priorities once he assumes office around 30 September 2026, and whether the new BfDI/Bundesnetzagentur dual-regulator model for the Data Act produces early jurisdictional friction or, conversely, the intended consistency and speed benefits the DADG was designed to deliver. Evidence 9 Sources and claims (9) - Probable[Bundesbeauftragte für den Datenschutz und die Informationsfreiheit](https://www.bfdi.bund.de/) — BfDI supervises federal public bodies and federally-regulated private-sector entities (post and telecoms sectors). Core supervisory-competence allocation.observed 2026-07-29 - Probable[Bundesbeauftragte für den Datenschutz und die Informationsfreiheit](https://www.bfdi.bund.de/) — 17 Land data protection authorities supervise private-sector processing and Land-level public bodies (Bavaria splits public/private-sector oversight). Federated supervisory structure.observed 2026-07-29 - Probable[BfDI](https://www.bfdi.bund.de/SharedDocs/Downloads/DE/Broschueren/INFO1.pdf) — Bundesdatenschutzgesetz (BDSG-neu) supplements the GDPR as a subsidiary national implementing act, applying only where the GDPR permits derogation or leaves gaps.observed 2026-07-29 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/opinion/germany-faqs-what-does-ttdsg-mean-you) — TTDSG (now TDDDG) functions as lex specialis for telecom/telemedia and cookie/tracking consent matters. TTDSG renamed TDDDG following Digital Services Act adaptation.observed 2026-07-29 - Probable[BfDI](https://www.bfdi.bund.de/DE/BfDI/Inhalte/Datenschutzpfad/DSGVO.html) — GDPR Article 2 defines material scope covering wholly/partly automated processing and structured manual filing systems, directly applicable in Germany.observed 2026-07-29 - Probable[BfDI](https://www.bfdi.bund.de/DE/BfDI/Inhalte/Datenschutzpfad/DSGVO.html) — GDPR Article 3(2) extends territorial scope to non-EU controllers targeting or monitoring individuals in Germany/the EU.observed 2026-07-29 - Probable[BfDI](https://www.bfdi.bund.de/DE/Service/Inhalte/Flyer/Postdienstleister/4-Datenschutzbeauftragte.html) — Federally-supervised entities must file DPO contact details with BfDI via a dedicated notification form/portal.observed 2026-07-29 - Confirmed[BfDI](https://www.bfdi.bund.de/SharedDocs/Pressemitteilungen/DE/2026/01_ReguLab.html) — BfDI requires: Prof. Dr. Moritz Hennemann took office as Federal Commissioner for Data Protection and Freedom of Information on 1 October 2026, succeeding Prof. Dr. Louisa Specht-Riemenschneider, after election by the Bundestag (June 2026) and appointment by Federal President Frank-Walter Steinmeier (29 September 2026). - Uncertain[BfDI](https://www.bfdi.bund.de/SharedDocs/Pressemitteilungen/DE/2026/05_BfDI-R%C3%BCckzug.html) — BfDI (Hennemann priorities) proposes: Commentary frames Hennemann's priorities as including a planned reform of Germany's data-protection supervisory structure consolidating the federal/Laender 17-body system, and a prospective 'Data Code'; neither has produced enacted legislative text as of this cycle.