🇩🇪 Germany

Informations

Extracts :

Extract :

"There are no definitions for the below listed terms in the part of the BDSG that supplements the GDPR."

Reference :

BLANK

Extract :

The GDPR protects persons, despite their nationality or location.

2016

Reference :

General Data Protection Regulation

GDPR articles and chapters

Link to reference

Extracts :

Extract :

"There are no definitions for the below listed terms in the part of the BDSG that supplements the GDPR."

Reference :

BLANK

Extract :

The GDPR protects persons, despite their nationality or location.

2016

Reference :

General Data Protection Regulation

GDPR articles and chapters

Link to reference

Extracts :

Extract :

No mention of the subject rignt related to Legal entities

Reference :

BLANK

Extracts :

Extract :

"According to Section 1 (4) of the BDSG, the BDSG applies to public bodies. It also applies to private bodies i: the controller or processor processes personal data in Germany; personal data is processed in the context of the activities of an establishment of the controller or processor in Germany; or although the controller or processor does not have an establishment in a Member State of the EU or in another contracting state of the European Economic Area, it falls within the scope of the GDPR."

Reference :

BLANK

Extracts :

Extract :

Reference :

BLANK

Extract :

"The GDPR applies to organizations that have a presence in the EU. In particular, per Article 3, the GDPR applies to entities or organizations established in the EU, notably entities that have an 'establishment' in the EU or if processing of personal data takes place in the context of the activities of that establishment, irrespective of whether the data processing takes place in the EU or not."

2022

Reference :

Canada Data protection overview | DataGuidance

(Data Protection Overview 2021)/ DataGuidance reports

Extracts :

Extract :

"As exception, Article 6 provides that these sensitive data can be processed in the cases mentioned in Article 9(2) of the GDPR and for processing justified by public interest and duly authorised.

Reference :

France Data protection overview | DataGuidance

(Data Protection Overview 2021)/ DataGuidance reports

Extract :

"There are no definitions for the below listed terms in the part of the BDSG that supplements the GDPR."

Reference :

BLANK

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

"Special Category Data - The DPDP Act does not contain any provisions on special category data."

2023

Reference :

Decrypting India's New Data Protection Law: Key Insights and Lessons Learned

Information on India's DPDP act | Bird&Bird

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

There is nothing in the official text on this.

Reference :

What personal data is considered sensitive?

Information on sensitive data in the GDPR

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Filled on the basis of extract ID 822 (for EU) which should apply.

2016

Reference :

What are the GDPR Fines?

Information on GDPR fines

Link to reference

Extracts :

Extract :

Filled on the basis of extract ID 843 (for EU) which should apply.

2016

Reference :

What are the GDPR Fines?

Information on GDPR fines

Link to reference

Extracts :

Extract :

Filled on the basis of extract ID 864 (for EU) which should apply.

2016

Reference :

General Data Protection Regulation

GDPR articles and chapters

Link to reference

Extracts :

Extract :

Data entered based on reference.

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Filled on the basis of extract ID 864 (for EU) which should apply.

2016

Reference :

General Data Protection Regulation

GDPR articles and chapters

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Based on value in 469 (general GDPR) which should apply to this case.

2016

Reference :

General Data Protection Regulation

GDPR articles and chapters

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Filled on the basis of extract ID 5647 which applies for FRA and should apply here as well (GDPR).

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

"The BDSG limits data subjects' right to object according to Article 21 of the GDPR in the following ways: Section 28(4) of the BDSG provides that in the case of data processing for archiving purposes in the public interest, the right to object to data processing does not apply as far as it renders impossible or seriously impairs the achievement of the archiving purposes, and the limitation is necessary to fulfil those purposes: • in cases of data processing for purposes of scientific or historical research and for statistical purposes, the right to object is limited to the extent that it is likely to render impossible or seriously impair the achievement of research or statistical purposes and such limits are necessary for the fulfilment of the research and statistical purposes (Section 27(2) of the BDSG); and • with regard to public bodies, the right to object does not apply if the processing is required by law or if there is an urgent public interest in the processing which outweighs the interests of the data subject (Section 36 of the BDSG)."

Reference :

BLANK

Extracts :

Extract :

"Data subjects have a right to receive a copy of their personal data in a commonly used machine-readable format, and transfer their personal data from one controller to another or have the data transmitted directly between controllers."

Reference :

ICLG Website

Link to reference

Extracts :

Extract :

"8.7. Right not to be subject to automated decision-making According to Section 37 of the BDSG, the right not to be subject to a decision based solely on automated processing granted to data subjects under the GDPR shall not apply (in addition to the exceptions included in the GDPR itself) if the decision is made in the context of providing services under an insurance contract and either of the following applies: • any requests for performance of the data subject were fulfilled; or • in the event that the data subject's request for performance is not granted in full, the decision is based on the application of binding rules of remuneration for therapeutic treatment and the controller takes suitable measures to safeguard the data subject's legitimate interests, such as granting the right to obtain human intervention on the part of the controller, to express his/ her point of view and to contest the decision. Section 37(2) of the BDSG clarifies that decisions based solely on automated processing may be based on the processing of health data."

Reference :

BLANK

Extracts :

Extract :

"Section 27(2) of the BDSG provides that in cases of data processing for purposes of scientific or historical research or for statistical purposes, the following rights of data subjects are limited to the extent that these rights are likely to render impossible or seriously impair the achievement of the research or statistical purposes and such limits are necessary for the fulfilment of the research or statistical purposes: • right of access (Article 15 of the GDPR); • right to rectification (Article 16 of the GDPR); • right to restriction of processing (Article 18 of the GDPR); and • right to object (Article 21 of the GDPR."

Reference :

BLANK

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Reference :

BLANK

Extracts :

Extract :

Reference :

BLANK

Extracts :

Extract :

Reference :

BLANK

Extracts :

Extract :

"8.4. Right to erasure Article 2 of the Data Protection Law gives the data subject the right to erase their personal data."

2021

Reference :

Egypt Data protection overview | DataGuidance

(Data Protection Overview 2021)/ DataGuidance reports

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

"The Regulations do not explicitly refer to conditions for obtaining consent to process children's data. However, Section(5)(f) states that processing is lawful only if and to the extent that, among other things, processing is necessary for the purposes of legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests of the data subject which require protection of personal data, in particular where the data subject is a child."

2022

Reference :

GDPR vs countries' comparison | DataGuidance

Comparison of GDPR vs countries' data protection laws, definitions etc. - ARE

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Filled based on value observed in extract ID 1395/1361 etc. (GDPR) which should apply here as well.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

International Data transfer Agreements | DataGuidance

Comparison of international data transfer agreements

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Filled based on value observed in extract ID 301 (GDPR) which should apply here as well.

2016

Reference :

General Data Protection Regulation

GDPR articles and chapters

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

"The Act does not specifically define a principle of accountability, although many of its provisions may be considered to relate to accountability expectations."

2022

Reference :

GDPR vs countries' comparison | DataGuidance

Comparison of GDPR vs countries' data protection laws, definitions etc. - KEN

Extracts :

Extract :

"The PDPL does not make express reference to DPO tasks, however Article 30(2) provides that the Regulations shall set out further provisions relating to the appointment of a DPO."

2022

Reference :

GDPR vs countries' comparison | DataGuidance

Comparison of GDPR vs countries' data protection laws, definitions etc. - SAU

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extract :

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extract :

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extract :

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extract :

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extract :

Extracts :

Extract :

Extracts :

Extract :

"The Bill does not refer to general requirements to demonstrate compliance. Nevertheless, the NCPDP is empowered to formulate a compliance framework for monitoring and enforcement in order to ensure transparency and accountability (Section 34.2(c))."

2021

Reference :

GDPR vs countries' comparison | DataGuidance

Comparison of GDPR vs countries' data protection laws, definitions etc. - PAK

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Actors
Name	Short name	Classification	Jurisdiction	Year of creation
Federal Cartel Office (FCO)		Regulator	Independant agency	1958
Federal Network Agency (BNetzA)		Regulator	Under the government authority	2005
German Federal Office for Information Security (BSI)		Regulator	Under the government authority	1991
Federal Commissioner for Data Protection and Freedom of Information (BfDI)	BfDI	Regulator	Independant agency	1978
Federal Ministry for Economic Affairs and Climate Action		Regulator	Ministry	1917

Texts
Legal text name	Original text name	Legislation type	Year signed	Regulation status	In effect since	Latest update initiated	Latest update areas	Latest update signed year
General Data Protection Regulation (GDPR)	Bundesdatenschutzgesetz (BDSG)	General privacy/data protection law	1970	Active	1970	2016		2018

🇩🇪 Germany

Data subject classification

Citizens outside their jurisdiction are considered as data subjects : Yes

Persons within their jurisdiction are considered as data subjects : Yes

Legal entities are considered as data subjects : No

Data controller definition and responsibilities

Organizations located outside the jurisdiction processing regulated subjects data are considered as data controllers within the personal data legislation : Yes

Organizations with economic activities within the jurisdiction are considered as data controllers within the personal data legislation : Yes

Differentiation between how data controller and data processor are defined : Yes

Organizations located outside the jurisdiction monitoring regulated subjects data are considered as data controllers within the personal data legislation : Yes

Special/sensitive personal data definition

Definition of personal data that are "special" or "sensitive": financial data : No

Definition of personal data that are "special" or "sensitive": genetic data : Yes

Definition of personal data that are "special" or "sensitive": biometric data : Yes

Definition of personal data that are "special" or "sensitive": medical/health data : Yes

Definition of personal data that are "special" or "sensitive": criminal records data : Yes

Definition of personal data that are "special" or "sensitive": racial/ethnic origin : Yes

Definition of personal data that are "special" or "sensitive": political opinions : Yes

Definition of personal data that are "special" or "sensitive": religious/philosophical beliefs : Yes

Definition of personal data that are "special" or "sensitive": trade union membership : Yes

Definition of personal data that are "special" or "sensitive": geo-location data : No

Legal bases for data processing

Potential legal bases for processing personal data: appropriate notice has been provided to or made available to the data subject : No

Potential legal bases for processing personal data: the data subject has provided consent to the processing for the identified purposes : Yes

Potential legal bases for processing personal data: the personal data is necessary to perform a contract with the data subject : Yes

Potential legal bases for processing personal data: the personal data is necessary to comply with a legal obligation : Yes

Potential legal bases for processing personal data: the personal data is necessary to protect the vital interests of a natural person : Yes

Potential legal bases for processing personal data: the personal data is necessary for a public interest : Yes

Potential legal bases for processing personal data: the personal data is necessary to fulfil a legitimate interest of the controller or third party : Yes

Enforcement and penalties

Provision of administrative penalties by laws : Yes

Max value of monetary penalties for violations (in euros) : 20000000

Consideration of turnover rates for penalties? : Yes

Provision of criminal penalties - fines : Yes

Subject private remedies - presence of individual personal actions? : Yes

Subject private remedies - representative actions? : Yes

Subject private remedies - class actions? : No

Subject private remedies - file complaints with Data Protection Authorities? : Yes

Provision of criminal penalties - imprisonment : No

Data processing and security controls

Audit or supervise Data Processors : Yes

Requirement of a DPIA : Yes

Ensuring encryption/pseudonymisation as a security control : Yes

Requirement for Controller to notify subjects of a data breach : Yes

Requirement for Controller to notify DPA of a data breach : Yes

Requirement for Processor to notify controller of data breach : Yes

Requirement for Processor to notify DPA of data breach : No

Requirement for Processor to notify subjects of data breach : No

Obligation to maintain information security control to protect personal data from unauthorized access or processing: general technical/physical/organizational security controls : Yes

Rights of data subjects

Right to object data use or/opt out : Yes

Right to data portability : Yes

Right against automated decision making : Yes

Right to be informed : Yes

Consent required for processing children's data : Yes

Right to access information : Yes

Right to rectification : Yes

Right to erase : Yes

Right to withdraw consent : Yes

Right to restrict data processing : Yes

International data transfer and data localization

Legal basis for international data transfer: approved jurisdictions : Yes

Legal basis for international data transfer: approved standard contractual clauses : Yes

Legal basis for international data transfer: derogations, such as consent, contract performance, necessity to establish, exercise or defend legal claims : Yes

Legal basis for international data transfer: binding corporate rules : Yes

Data localisation requirements: retention of personal data in local jurisdiction : No

Data localisation requirements: tax or financial record laws : Yes

Legal basis for international data transfer: EU/EEA adequacy : Yes

Legal basis for international data transfer: Convention 108 : Yes

Data localisation requirements: national security laws : No

Legal basis for international data transfer: APEC CBPRs : No

Data localisation requirements (such data is part of another type of record or dataset): retention or storage of personal data in the local jurisdiction or otherwise prohibit the transfer or disclosure of the personal data outside of the local jurisdiction : No

Data localisation requirements: anti-investigatory/blocking statutes that restrict any activity on local territory that aids a foreign government investigation : No

Data localisation requirements: other data localization regulations (export control laws/medical laws/employment laws etc.) : Yes

Data protection officer (DPO) requirements

Consulting the supervisory authority (DPA) before data processing : Yes

Mandatory appointment of a DPO : Yes

Requirement of professional/legal qualification/expert knowledge for DPO : Yes

Clear DPO role specification : Yes

Group appointments: a group of undertakings to appoint a single DPO : Yes