Bundesdatenschutzgesetz (Germany)
What the BDSG covers, and what it means for your website analytics
Official name: Bundesdatenschutzgesetz (BDSG), the German Federal Data Protection Act. The current version has applied since 25 May 2018, alongside the GDPR, and adds Germany-specific rules on processing personal data.
See all privacy lawsAt a glance
Germany's own additions to the GDPR
The GDPR leaves some areas for each EU country to settle. The BDSG fills them in for Germany, covering topics such as employee data, video surveillance and when a company must appoint a data protection officer.
It also sets the rules for federal public bodies, and for police and criminal justice authorities.
Who it covers
Private companies and federal public bodies that process personal data in Germany
What it means for websites
GDPR first; firms where 20+ people handle data need a data protection officer
Who enforces it
German state data protection authorities, and the BfDI for federal bodies
Maximum fines
Mostly GDPR fines, up to €20 million or 4% of turnover, plus BDSG fines and penalties
Further reading
Everything you need on this law
The BDSG
The official English translation of Germany’s Federal Data Protection Act, from the Federal Ministry of Justice.
Read the official textGermany’s federal data protection authority
The BfDI’s guidance on the BDSG and GDPR, available in English.
Visit the BfDIThe GDPR
The EU regulation the BDSG supplements. Most German data protection rules start here.
Read the official textThe TDDDG
Germany’s other key privacy law for websites, setting the rules on cookies and device access.
Read our TDDDG guideMore privacy laws
Guides to 14 more laws, from the GDPR to the CCPA, and what each one asks of your website.
See all privacy lawsTWIPLA and the BDSG
German analytics, hosted in Germany
TWIPLA's GDPR legal basis covers Germany too. In Maximum Privacy Mode, that's legitimate interest under Art. 6(1)(f), with no visitor consent needed.
For German organizations, where the data goes matters as much as what's collected:
- TWIPLA is made by Visitor Analytics GmbH, based in Ottobrunn near Munich
- All data is stored and processed in Hetzner's data center in Falkenstein, Germany
- Our content delivery network runs only on European providers, outside the reach of the US CLOUD Act
- Location lookups run locally, with no external services involved
- Our Data Processing Agreement lists every subprocessor
Duties the BDSG places on you, such as appointing a data protection officer where required, stay with you as the controller.
Proof, not promises
How TWIPLA meets the BDSG
GDPR & ePrivacy statement
Where TWIPLA stores and processes data, and which subprocessors it uses, all within Germany and the EU.
Read the statementConsentless analytics, explained
The legal case for banner-free analytics under the GDPR and German law, written for your DPO.
Read the legal caseWhy we host in Germany
Why TWIPLA keeps all analytics data in German data centers, run by Hetzner.
Read the articleOur Data Processing Agreement
The Art. 28 GDPR agreement every TWIPLA customer signs, with all subprocessors listed.
Read the agreementTechnical University of Munich
How Germany’s Technical University of Munich gets the full picture of its traffic while keeping visitor data protected.
Read the success storyLegal disclaimer
Helpful guidance, not legal advice
This page explains the law in general terms. Laws change, and how they apply depends on your business, your visitors and how you configure TWIPLA.
Unless another mode is named, statements about compliance refer to Maximum Privacy Mode, our default setting. For advice on your situation, please consult a qualified legal professional.
Questions about how TWIPLA fits this law? Email our team at consentless@twipla.com.
