#
Telecom/eprivacy and health overlays are well-developed and green; credit-scoring/Art 22 interface remains actively contested at CJEU level, and education/insurance sub-modules lack identified DE-specific overlays, justifying an overall amber rating.
Sub-modules (7)
Financial Sector OverlayAmber
No dedicated DE financial-sector DP overlay beyond GDPR/BDSG and credit-scoring rules (§31 BDSG) was identified separately from credit_and_scoring.
Absence provenance: unavailable. Searched: BaFin Datenschutz Überschneidung BDSG.
Health Sector OverlayGreen
Mandatory electronic patient record (ePA) obligation for statutory health insurers since 15 Jan 2025, with active BfDI guidance/regulatory sandbox activity (ReguLab, §25b SGB V).
Claims (1):
- Statutory health-insurance members subject to mandatory electronic patient record (ePA) processing since 15 January 2025. No dedicated ePA-specific document independently retrieved this pass.
Telecoms And EprivacyGreen
TTDSG/TDDDG cookie-consent regime plus Consent Management Ordinance (April 2025).
Claims (2):
- TTDSG/TDDDG §25(1)/(2) requires consent for storage of or access to information on end-user terminal equipment, subject to a narrow strict-necessity exception.
- Consent Management Ordinance became effective 1 April 2025, establishing centralized consent-service recognition procedures.
Employment DataAmber
§26 BDSG plus ancillary labour statutes govern employment-context processing.
Claims (1):
- §26 BDSG plus ancillary labour statutes govern employment-context personal data processing in Germany.
Credit And ScoringAmber
§31 BDSG credit-scoring practice intersects with Art 22 GDPR automated-decision prohibition; actively before the CJEU (SCHUFA line of cases).
Claims (1):
- §31 BDSG credit-scoring rules intersect with GDPR Art 22 automated-decision-making prohibition, actively litigated at CJEU level (SCHUFA line of cases). See also M8 profiling_restrictions / automated_decision_making_transparency claims for the CJEU dimension.
EducationRed
No DE-specific education-sector DP overlay distinct from general GDPR/BDSG was identified.
Absence provenance: unavailable. Searched: Schuldatenschutz Deutschland Landesrecht, education sector Germany data protection overlay.
InsuranceRed
No DE-specific insurance-sector DP overlay distinct from general GDPR/BDSG was identified beyond credit/scoring intersections.
Absence provenance: unavailable. Searched: Versicherungsaufsicht Datenschutz Deutschland BDSG.
Key findings (3)
- — source on file
- — source on file
- — source on file
Sectoral Watch
Germany has designated the Bundesnetzagentur as its single competent authority and point of contact for the EU Data Act, which has been in force since 12 September 2025. This designation carries with it a significant penalty structure: the top tier of sanction under the Data Act's German enforcement architecture reaches up to 5,000,000 fixed or up to 2% of global turnover for undertakings exceeding 250,000,000 in worldwide turnover in the prior financial year. No new enforcement action under this framework has been identified this cycle; the designation and penalty-tier structure stand as confirmed background rather than as the subject of any new dated development.
This designation is worth reading alongside the Bundesnetzagentur's separate new role under the KI-MIG as Germany's central AI market-surveillance authority (see Algorithmic, Biometric & Surveillance Governance). The Bundesnetzagentur is accumulating a broadening data-and-technology regulatory portfolio in Germany, spanning data-access-and-sharing obligations under the Data Act and AI market-surveillance under the KI-MIG, in addition to its original telecommunications-sector mandate. This concentration of competence in a single authority is a structural fact about the German regulatory landscape that is likely to be relevant to future sectoral-watch developments as the Data Act's practical enforcement record develops.
Outlook
No enforcement action under the Data Act has yet been identified for Germany; whether the Bundesnetzagentur initiates any such action, and how it coordinates data-access-and-sharing enforcement under the Data Act with its AI market-surveillance role under the KI-MIG given the overlapping subject matter in AI systems that rely on shared or accessed data, are both worth monitoring going forward.
1 earlier distinct update(s)
Sectoral Watch
The DADG's entry into force on 30 May 2026 is understood, per law-firm commentary, to centralise personal-data supervision under the EU Data Act with the BfDI specifically, in order to ensure consistent decisions and shorter complaint-handling procedures and to avoid divergent enforcement across Germany's seventeen data-protection supervisory authorities. This is a probable, Tier-3-sourced characterisation of the government's intent behind the law rather than a Tier-1 confirmed statement, though it is consistent with the confirmed Tier-1 finding that the BfDI now holds this competence in force. The Data Act itself sits at the intersection of data-protection and broader data-economy regulation, making this a genuinely cross-sectoral development: the BfDI's jurisdiction here covers the Data Act's personal-data aspects specifically, while the Bundesnetzagentur retains general central supervisory and enforcement authority over the Data Act as a whole.
This dual-regulator model for a single EU instrument is the notable sectoral-watch feature of this cycle: rather than a fragmented multi-Land approach, Germany has chosen a two-federal-body split specifically to concentrate personal-data-related Data Act enforcement in one authority, avoiding the divergence risk that fragmented Länder-level supervision might otherwise create for this particular instrument.
Outlook
Watch for the first concrete BfDI enforcement or guidance action taken under its new Data Act personal-data competence, which would be the first practical test of whether the centralisation rationale behind the DADG's dual-regulator design delivers the intended consistency and speed benefits.
Sources and claims (5)
- UncertainBundesbeauftragte für den Datenschutz und die Informationsfreiheit — Statutory health-insurance members subject to mandatory electronic patient record (ePA) processing since 15 January 2025. No dedicated ePA-specific document independently retrieved this pass.observed
- ProbableBfDI — TTDSG/TDDDG §25(1)/(2) requires consent for storage of or access to information on end-user terminal equipment, subject to a narrow strict-necessity exception.observed
- ProbableOneTrust DataGuidance — Consent Management Ordinance became effective 1 April 2025, establishing centralized consent-service recognition procedures.observed
- ProbableBfDI — §26 BDSG plus ancillary labour statutes govern employment-context personal data processing in Germany.observed
- ProbableEUR-Lex / CJEU — §31 BDSG credit-scoring rules intersect with GDPR Art 22 automated-decision-making prohibition, actively litigated at CJEU level (SCHUFA line of cases). See also M8 profiling_restrictions / automated_decision_making_transparency claims for the CJEU dimension.observed