The EU GDPR applies directly in Germany and is supplemented by the Federal Data Protection Act (BDSG) and the TDDDG for cookies and similar technologies. Supervision of most businesses sits with the 16 state authorities rather than one national regulator, so where you are established decides who you deal with. NIS2 has been in force since 6 December 2025 through the amended BSI Act, with self-assessment, BSI registration and short incident-reporting deadlines. Domestic B2B e-invoicing is phasing in, with full issuing obligations from 2027 or 2028 depending on turnover.
Who supervises your data processing
Germany does not have a single data protection regulator for business. The data protection authority of the federal state where the company is established supervises most private-sector processing; the Federal Commissioner (BfDI) covers federal bodies and telecoms and postal providers for their service data. Bavaria has a separate private-sector authority. For a group with sites in several states, this can mean more than one authority and some variation in interpretation, which is why consistent internal policies matter.
Reform is under discussion. A Bundesrat bill would give the Datenschutzkonferenz (the joint body of the authorities) binding majority decisions and a single lead authority for affiliated companies, and the Federal Government has said it will table its own supervision reform. None of this is in force yet.1234
German additions to the GDPR
The BDSG requires a data protection officer more often than the GDPR alone: once at least 20 people are constantly engaged in automated processing, or regardless of size where a data protection impact assessment is needed or data is processed commercially for transfer or market research. Foreign groups setting up a German subsidiary often miss this threshold as headcount grows.
Cookies, tracking pixels and similar device access require prior consent under § 25 TDDDG unless they are strictly necessary for a service the user requested. This is enforced alongside the GDPR rules on the subsequent processing.56
NIS2 cyber security obligations
The NIS2 implementation act entered into force on 6 December 2025 and rewrote the BSI Act. Businesses in the listed sectors are important entities from 50 employees or more than EUR 10 million in both turnover and balance sheet total, and particularly important entities from 250 employees or more than EUR 50 million turnover and EUR 43 million balance sheet. The BSI does not tell businesses whether they are in scope; each must assess itself, including at group level using EU SME counting rules.
In-scope entities must register with the BSI within three months of meeting the criteria, report significant incidents in stages (24 hours, 72 hours, one month), and implement risk-management measures under management oversight, with management training duties. Fines reach EUR 10 million or 2% of worldwide turnover for particularly important entities. By 30 September 2026 more than 20,000 registrations had been made.7891011121314
Domestic B2B e-invoicing
Since 1 January 2025 businesses in Germany must be able to receive structured e-invoices for domestic B2B supplies. Issuing obligations phase in: paper or other formats (with consent) remain permitted until the end of 2026, and until the end of 2027 for issuers with prior-year turnover up to EUR 800,000 or for EDI invoices. Finance systems for a German entity should be built to issue and archive compliant e-invoices from the outset.1516
| Category | General size test (Annex sectors) | Always in scope regardless of size | Maximum fine (core breaches) |
|---|---|---|---|
| Particularly important entity | 250+ employees, or turnover above EUR 50m and balance sheet above EUR 43m (Annex 1 sectors) | Critical installation operators, qualified trust service providers, TLD registries, DNS providers | EUR 10m or 2% of worldwide turnover |
| Important entity | 50+ employees, or turnover and balance sheet each above EUR 10m (Annex 1 or 2 sectors) | Trust service providers | EUR 7m or 1.4% of worldwide turnover |
How it works, step by step
- Assess whether the German entity (and group) falls within an Annex 1 or Annex 2 sector and meets the size thresholds789The business itself (self-assessment)
- Register on the BSI portal within three months of meeting the criteria10Bundesamt für Sicherheit in der Informationstechnik (BSI)
- Set up incident reporting so that early warnings can reach the BSI within 24 hours11BSI and BBK joint reporting office
- Check data protection officer requirement and identify the competent state data protection authority15State data protection authority (Land)
No timings or fees are shown unless an official source states them.
Documents usually needed
- Records of processing activities and data protection impact assessments where required
- Data protection officer appointment and notification of contact details
- Cookie consent mechanism and consent records
- NIS2 scope assessment and BSI registration confirmation
- Incident response plan aligned to 24-hour, 72-hour and one-month reporting
- E-invoicing capability for receipt now and issuance by the applicable transition date
Common mistakes
- Assuming one national data protection regulator, and not identifying the state authority competent for each German site.
- Missing the 20-person data protection officer threshold as a German team grows.
- Waiting for the BSI to confirm NIS2 status; the duty to assess and register lies with the business.
- Counting only the German entity's headcount for NIS2 when group figures may count under EU SME rules.
- Treating a PDF invoice as a compliant e-invoice after the transition period ends.
When the business crosses borders
- Transfers of personal data from Germany to non-EU countries follow GDPR Chapter V (adequacy decisions, standard contractual clauses or other safeguards); there is no separate German transfer regime.
- An entity providing services in several EU states must list those states in its BSI registration, and groups may face registration in more than one member state.
- Germany has no general data localisation requirement for private-sector data under the GDPR framework, but sector rules (for example health, public sector contracts) may impose hosting conditions.
Questions businesses ask
Which authority supervises our German subsidiary's data processing?
Normally the data protection authority of the federal state where the subsidiary is established. The BfDI supervises federal bodies and telecoms and postal providers for their service data.123
Is our German company covered by NIS2?
Check whether it operates in a sector listed in Annex 1 or 2 of the BSI Act and meets the size tests (from 50 employees or more than EUR 10 million turnover and balance sheet). Some entity types are covered regardless of size. If covered, register with the BSI within three months.8910
What this guide does not yet confirm
These points need checking with a qualified local professional in Germany before you rely on them.
- Exact NIS2 registration grace arrangements: secondary sources mention a sanction-free window to 31 July 2026; not confirmed on an official page.
- The operative text of § 30 (risk-management measures) and § 38 (management duties) BSIG was not reviewed in detail.
- Outcome of the Bundesrat BDSG bill (Drucksache 21/7732) and any Federal Government supervision reform proposal after August 2026.
- Reports of plans to relieve small businesses from some data protection duties (including the DPO threshold) were seen only in non-official sources.
- The European Commission adequacy page could not be loaded, so the current list of adequacy decisions is not recorded as a claim.
- The BMF e-invoicing FAQ blocks automated access; the receipt obligation is recorded as research draft.
Sources and review status
Each statement is numbered to the source it was checked against. We use official sources where we can, and each statement says whether it was checked against an official or a secondary source. Sources last checked on 18 October 2026. None of it has been professionally reviewed yet: it is research checked against official and secondary sources by WONE Global, not legal or tax advice.
Most private-sector businesses in Germany are supervised for data protection by the data protection authority of the federal state (Land) in which they are based, not by the Federal Commissioner (BfDI). Private companies, associations and freelancers. Broadcasting, press and church bodies have their own supervisory authorities.
The BfDI supervises federal public bodies and, for the personal data they process to provide those services, telecommunications and postal service providers. Telecoms and postal providers only for service-related processing; other activities such as employee data or address trading fall to the state authority.
The Datenschutzkonferenz lists 17 state data protection supervisory authorities for the 16 federal states, because Bavaria has a separate authority for the private sector (Bayerisches Landesamt für Datenschutzaufsicht). Bavaria: separate authorities for the public and private sectors; other states: one authority each.
A Bundesrat bill to amend the BDSG (Bundestag document 21/7732) would put the Datenschutzkonferenz on a statutory footing with binding majority decisions and create a single lead supervisory authority for affiliated companies; the Federal Government has said it will present its own proposal on reforming supervision. Pending legislation as reported on 27 August 2026; not in force.
Status after 27 August 2026 not confirmed. The coalition's earlier plan to concentrate business supervision at the BfDI (BfDI press release 4/2025) has not been enacted as far as could be confirmed.
Under the Federal Data Protection Act (BDSG), controllers and processors must appoint a data protection officer if they generally employ at least 20 people who are constantly engaged in automated processing of personal data, in addition to the GDPR Article 37 cases. Regardless of headcount, a data protection officer is also required where processing needs a data protection impact assessment (Art. 35 GDPR) or personal data is processed commercially for transfer, anonymised transfer or market or opinion research.
Storing information on, or reading information from, a user's device (for example through cookies) requires the user's consent based on clear and comprehensive information, under § 25 of the Telecommunications Digital Services Data Protection Act (TDDDG). No consent needed where the sole purpose is transmitting a message over a public telecoms network, or where access is strictly necessary to provide a digital service the user expressly requested (§ 25(2)).
Germany's NIS2 implementation act (NIS2-Umsetzungs- und Cybersicherheitsstärkungsgesetz) was promulgated on 5 December 2025 and entered into force on 6 December 2025, with the BSI as the competent supervisory authority for in-scope entities. Entities in the sectors listed in Annexes 1 and 2 of the BSI Act (BSIG) that meet the size thresholds, plus certain entity types regardless of size.
The BSI does not notify entities of their status; businesses must assess for themselves whether they are in scope.
Under § 28 BSIG, an entity in an Annex 1 sector is a particularly important entity (besonders wichtige Einrichtung) if it has at least 250 employees, or annual turnover above EUR 50 million and a balance sheet total above EUR 43 million. Operators of critical installations, qualified trust service providers, TLD registries and DNS service providers are particularly important regardless of size; telecoms providers qualify from 50 employees or turnover and balance sheet each above EUR 10 million.
Under § 28 BSIG, an entity in an Annex 1 or Annex 2 sector is an important entity (wichtige Einrichtung) if it has at least 50 employees, or annual turnover and balance sheet total each above EUR 10 million, and is not a particularly important entity. Trust service providers are important entities regardless of size. Headcount and turnover are counted using EU SME Recommendation 2003/361/EC (per BSI FAQ).
Particularly important and important entities must register with the BSI no later than three months after they first (or again) meet the criteria, giving details including legal form, register number, contact details, public IP address ranges, sector and the EU states where they provide services. Registration is made through the joint BSI and BBK portal.
Some secondary sources refer to a later sanction-free registration window ending 31 July 2026; this was not confirmed on an official page.
Significant security incidents must be reported to the joint BSI and BBK reporting office with an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report no later than one month after the notification. Particularly important and important entities. An intermediate report is due only on BSI request; a progress report replaces the final report while an incident is ongoing.
Maximum fines for core NIS2 breaches are EUR 10 million or 2% of worldwide turnover for particularly important entities, and EUR 7 million or 1.4% of worldwide turnover for important entities. Turnover-based caps apply where the undertaking's worldwide turnover exceeds EUR 500 million; covers the offences listed in § 65(5) sentence 1 no. 1 BSIG.
The BSI Act places implementation, oversight and training duties on the management of particularly important and important entities. Content of the duties is set out in § 38 BSIG; detail not reviewed for this record beyond the section heading.
Only the section heading was checked; the operative text of § 38 should be read before relying on detail.
By 30 September 2026, 20,373 NIS2 registrations had been made with the BSI, comprising 13,252 important entities, 6,837 particularly important entities and 232 branches registered in other EU states. Snapshot figures, last updated by the BSI on 7 October 2026.
Mandatory domestic B2B e-invoicing was introduced from 1 January 2025, from which date businesses in Germany must be able to receive structured electronic invoices. Domestic supplies between businesses established in Germany.
The BMF page blocks automated access. Statement supported by the official page title in search results; the receipt obligation detail should be confirmed on the page or in the BMF letter of 15 October 2025.
Transitional rules allow invoices for domestic B2B supplies to be issued on paper or, with the recipient's consent, in a non-compliant electronic format until 31 December 2026, and until 31 December 2027 for issuers whose prior-year total turnover did not exceed EUR 800,000. EDI invoices in a non-compliant format may also be used, with consent, for supplies until 31 December 2027.
Questions on this topic
16 statements on data protection, cyber security and e-invoicing in Germany, 1 not yet checked against a source
