By country

GDPR Policy Generator Germany

GDPR plus BDSG, the TDDDG cookie rules, the Impressum duty and a live Abmahnung industry.

Generate your GDPR policy Read the GDPR policy guide

German GDPR practice is documented practice. The state authorities publish their own audit questionnaires, and the Verzeichnis von Verarbeitungstätigkeiten - the Article 30 record - is the first document requested.

Germany is the strictest practical market in the EU, not because GDPR reads differently there but because three extra layers sit on top. The Bundesdatenschutzgesetz fills the GDPR opening clauses, the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG, formerly TTDSG) governs cookies in § 25, and the Digitale-Dienste-Gesetz carries the Impressum duty in § 5.

Enforcement is also decentralised. Sixteen state authorities plus the federal commissioner supervise different sectors, and they coordinate through the Datenschutzkonferenz rather than acting as one body. Guidance that is settled in one Land is sometimes still contested in another.

The distinctive German risk is private enforcement. Competitors and Abmahnvereine send cease-and-desist letters with cost demands over a missing Impressum, an unlawfully embedded Google Font or a cookie banner without a same-level reject button. That happens on a timescale of weeks, long before any regulator would act.

What a GDPR policy in Germany has to cover

A Verzeichnis von Verarbeitungstätigkeiten maintained in German
The § 38 BDSG DPO analysis, with the appointment notified to the state authority if it applies
Works council agreements for any tool capable of employee monitoring
Auftragsverarbeitungsverträge with every processor, in the Article 28 form
A breach procedure identifying the correct state authority for notification

How Germany actually moves personal data

Google Fonts and other remote assets

A Munich court held that loading Google Fonts from Google’s servers transmits the visitor’s IP address without a basis. Self-hosting fonts, maps and scripts is now the German default, and the policy should say which assets are self-hosted.

Employee data under § 26 BDSG

German employment processing has its own basis and its own limits, and works council co-determination applies to any tool capable of monitoring performance - which includes most analytics and ticketing systems.

Payment by Rechnungskauf and SEPA direct debit

Buy-now-pay-later and invoice purchase are dominant in German e-commerce and involve creditworthiness checks by SCHUFA or Creditreform, which is a disclosure and an Article 22 question at the same time.

Consent records under § 25 TDDDG

The burden of proving consent sits with you, and German courts have been willing to look at the actual banner implementation rather than the policy’s description of it.

Newsletter double opt-in

German case law effectively requires confirmed opt-in with a logged confirmation email. Single opt-in lists are the ones that generate Abmahnungen.

Third parties the draft will ask you about

Stripe · Klarna · PayPal · SCHUFA · DHL · Hetzner · IONOS · Matomo · CleverReach · Datev

The rules that apply

GDPR + BDSG

The BDSG carries German rules on employee data (§ 26), video surveillance, and the threshold at which a Datenschutzbeauftragter becomes mandatory.

§ 25 TDDDG

Consent before storing or accessing information on a device, with a narrow strictly-necessary exemption. This is the German cookie rule, and it is not GDPR.

§ 5 DDG - Impressum

A complete legal notice with company form, register number, VAT ID, managing directors and a contact route. Missing it is the most-abmahnt defect on the German web.

Mandatory data protection officer

Required where twenty or more people are constantly engaged in automated processing, or where processing needs a DPIA - a far lower bar than the GDPR default.

Widerrufsbelehrung

Distance-selling cancellation instructions in the statutory form. Getting the wording wrong extends the cancellation window from fourteen days to twelve months.

What the generated GDPR policy contains

Article 13 and 14 transparency notice
The full disclosure set, split by whether the data came from the person or from somewhere else.
Lawful basis register
Every processing activity mapped to one of the six bases, with the legitimate interests assessment written down where you rely on that basis.
Records of processing (Article 30)
The internal register a supervisory authority can ask for at any time, covering purposes, categories, recipients, transfers and retention.
Data subject rights procedure
How a request arrives, how identity is verified, who handles it, and the one-month clock with its two-month extension.
International transfer mechanism
Adequacy, SCCs with a transfer impact assessment, or the UK IDTA/addendum - named per destination, not asserted in general.
Breach detection and 72-hour notification
The internal escalation path, the assessment test, and the template for notifying the regulator and, where required, the individuals.
Processor and sub-processor controls
Article 28 terms, the sub-processor list, and the change-notification commitment your customers will ask for.

The German checklist

Publish a complete Impressum
Company name and legal form, address, contact, register court and number, VAT ID, and the person responsible for editorial content where you publish one.
Self-host every third-party asset you can
Fonts, icon sets, maps and analytics. Anything that phones home before consent is a live risk.
Check the DPO headcount threshold
Count everyone who regularly handles personal data automatically - including part-timers and contractors.
Use the statutory cancellation wording
Copy the model Widerrufsbelehrung and model withdrawal form rather than rewriting them.
Log double opt-in confirmations
Keep the confirmation email, timestamp and IP for every subscriber; it is the evidence that ends a marketing complaint.

Where this usually goes wrong

No Impressum, or an incomplete one

It must be reachable in two clicks from every page and carry the register court, register number, VAT ID and representative. This is the single most common cause of a German cease-and-desist letter.

Loading fonts, maps or scripts from US servers before consent

Each remote asset transmits an IP address. German courts have awarded damages for exactly this, and the fix - self-hosting - is cheaper than the letter.

A cookie banner where reject is a text link

Under § 25 TDDDG the German authorities expect reject at the same level as accept. The DSK guidance is explicit.

Not appointing a Datenschutzbeauftragter when the headcount rule bites

Twenty people regularly processing personal data by automated means triggers the duty regardless of company size, and the appointment must be notified to the state authority.

Wrong Widerrufsbelehrung wording

The cancellation instruction is prescribed almost word for word. A paraphrase extends the withdrawal period to a year and is independently actionable.

Frequently asked questions

Do I need a German-language privacy policy?

If you address the German market, yes in practice. Transparency under Article 12 requires plain, intelligible language for the audience, and German courts have treated English-only notices aimed at German consumers as failing that test.

What is an Abmahnung?

A formal cease-and-desist letter, usually from a competitor or an association, demanding you stop a practice and pay their legal costs. It is a private enforcement mechanism with no regulator involved, and it moves in weeks.

Is Google Analytics legal in Germany?

It can be, with consent obtained before the tag fires, IP anonymisation configured, a processor agreement in place and a documented transfer assessment. What is not defensible is loading it on page one before any consent.

When do I need a Datenschutzbeauftragter?

When twenty or more people are constantly engaged in automated processing of personal data, or when your processing requires a DPIA, or when you process for commercial transfer or market research. The threshold is German, not GDPR.

Does GDPR apply to a business outside the EU?

Yes, where you offer goods or services to people in the EU or monitor their behaviour. Article 3(2) is about where the person is, not where you are - and Article 27 may also require you to appoint an EU representative.

What is the difference between EU GDPR and UK GDPR?

The text is nearly identical, but they are separate laws with separate regulators, separate fine ceilings in different currencies, and separate transfer regimes. A business serving both needs both named, not "GDPR" as shorthand.

Do I need a Data Protection Officer?

Only where your core activities involve large-scale regular monitoring or large-scale special-category data, or you are a public authority. Many businesses do not need one - but if you do not have one, say who is accountable instead.

Is a GDPR policy the same as a privacy policy?

No. The privacy policy is the outward-facing notice. The GDPR policy set is the internal machinery - lawful basis register, ROPA, rights procedure, breach plan - that lets you answer a regulator when they ask how the notice is honoured.