Mastering GDPR & Data Privacy Compliance (DSGVO)

DSGVO steht für Datenschutz-Grundverordnung und ist die deutsche Bezeichnung für die GDPR-Verordnung.

Fachkräfte in Bereichen wie Compliance, IT-Sicherheit, HR, Recht und Data Governance benötigen Kenntnisse der GDPR, da sie häufig mit personenbezogenen Daten arbeiten.

Der Kurs vermittelt grundlegende Kenntnisse über GDPR-Prinzipien und Datenschutz-Governance, die für Fachkräfte relevant sind, die Datenschutzfunktionen innerhalb von Organisationen unterstützen.

Organisationen in Deutschland müssen sowohl die GDPR als auch nationale Datenschutzgesetze einhalten, um personenbezogene Daten rechtmäßig zu verarbeiten und die Rechte von Personen zu schützen.

Die DSGVO gewährt Betroffenen Rechte wie:

• Auskunftsrecht über gespeicherte Daten
  
• Recht auf Löschung (Recht auf Vergessenwerden)
  
• Recht auf Berichtigung
  
• Widerspruchsrecht gegen die Datenverarbeitung
  
  Diese Rechte stärken die Kontrolle über persönliche Daten.

Die DSGVO gilt europaweit, das BDSG ergänzt sie auf nationaler Ebene in Deutschland dort, wo die DSGVO den Mitgliedstaaten Spielraum lässt.

Eine Datenschutzerklärung informiert Nutzer darüber, welche Daten gesammelt werden, warum das geschieht und welche Rechte sie haben. Sie ist nach Art. 13 & 14 DSGVO bei jeder Datenerhebung verpflichtend.

Datenschutz bezieht sich auf den rechtlichen Schutz von personenbezogenen Daten und die Wahrung der Privatsphäre. Datensicherheit hingegen schützt Daten vor verlust, Diebstahl oder Beschädigung durch technologische Maßnahmen wie Verschlüsselung, Firewalls und regelmäßige Sicherheitsprüfungen.

DSGVO (Datenschutz-Grundverordnung) is simply the German name for the GDPR (General Data Protection Regulation) — the same EU regulation, translated. However, Germany has supplemented the GDPR with the Federal Data Protection Act (BDSG), which extends and adapts certain GDPR provisions for the German context — for example, setting a higher age of consent threshold, establishing specific employee data rules under §26 BDSG, and requiring DPOs in organisations with 20 or more staff engaged in automated data processing. Understanding this layered framework is essential for any organisation operating in Germany.

Yes — in many cases. Under §38 BDSG (which goes beyond Article 37 GDPR), German organisations must appoint a DPO if at least 20 persons are regularly engaged in automated personal data processing. Public authorities must always appoint one. The DPO must have the necessary professional qualifications and knowledge of data protection law — formal training and certification are strongly recommended to meet this requirement and demonstrate the required 'Fachkunde' (expert knowledge).

GDPR fines in Germany can reach up to €20 million or 4% of global annual turnover — whichever is higher. German supervisory authorities, including the BfDI (Federal Commissioner for Data Protection) and 16 state DPAs, are among Europe's most active enforcement bodies. Common violations resulting in fines include: insufficient cookie consent mechanisms, inadequate data subject access request handling, missing or incomplete Records of Processing Activities (RoPA), insufficient technical security measures, and unlawful employee monitoring. Proactive compliance — documented, auditable, and kept up to date — is the most effective defence.

The GDPR is the overarching EU regulation that applies across all 27 member states, setting baseline rights and obligations. The BDSG (Bundesdatenschutzgesetz) is Germany's national implementation law, which uses GDPR 'opening clauses' to introduce German-specific rules — particularly for employee data, public sector processing, and DPO requirements. The TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz), effective since 2021 (replacing the old TTDSG), governs how websites, apps, and digital services handle user data — particularly cookies, tracking, and consent. All three must be considered together for full German compliance.

Employee data processing in Germany is governed primarily by §26 BDSG, which permits processing only when strictly necessary for the employment relationship. This covers hiring, payroll, performance management, and termination. Workplace monitoring — including email monitoring, video surveillance, and GPS tracking — is subject to stringent necessity and proportionality tests, and typically requires involvement of the works council (Betriebsrat). Consent is rarely a valid basis for employee data processing in Germany, as genuine voluntariness is difficult to establish in an employment context. Employers must document all processing activities and inform employees transparently.

A DPIA (Datenschutz-Folgenabschätzung / DSFA) is a mandatory risk assessment under Article 35 GDPR, required before undertaking processing that is 'likely to result in a high risk' to individuals' rights and freedoms. In Germany, the BfDI and state DPAs publish lists of processing activities that always require a DPIA. These typically include: systematic employee monitoring, large-scale processing of sensitive data, profiling, biometric data processing, and AI-driven decision-making with significant effects. Failing to conduct a required DPIA is itself a GDPR violation and can trigger regulatory action.

Under the TDDDG (and earlier TTDSG), storing or accessing information on a user's device — including cookies, pixels, and tracking scripts — requires prior, informed, and voluntary consent, unless the technology is strictly necessary for the requested service. Pre-ticked boxes, implied consent, and consent obtained through 'dark patterns' are not valid. German courts and supervisory authorities have been particularly strict: the Bavarian DPA, Hamburg DPA, and others have issued guidance making it clear that most analytics and marketing cookies require a proper consent management platform (CMP) with granular opt-in choices. The 2026 EDPB coordinated action on transparency obligations further raises the compliance bar.

Germany has a uniquely decentralised data protection enforcement structure. The BfDI (Bundesbeauftragte für den Datenschutz und die Informationsfreiheit) supervises federal public bodies and certain private sector organisations with national reach. Each of Germany's 16 federal states has its own independent Datenschutzbehörde (DPA), responsible for supervising organisations in their jurisdiction. The Datenschutzkonferenz (DSK) — a conference of all German DPAs — issues joint guidance to ensure consistent application of the law. For cross-border cases, the EDPB (European Data Protection Board) coordinates EU-wide enforcement.

The EU AI Act, which entered application in phases from 2024–2026, creates a new layer of compliance obligations that intersect closely with GDPR. AI systems classified as 'high-risk' (e.g. those used in recruitment, credit scoring, biometric identification, or critical infrastructure) must meet stringent transparency, accuracy, and human oversight requirements — all of which have direct GDPR implications. Automated decision-making under Article 22 GDPR, which gives data subjects the right not to be subject to solely automated decisions with significant effects, becomes increasingly relevant as AI deployment expands. German organisations using AI must assess both GDPR and AI Act obligations simultaneously.

German regulators expect organisations to maintain comprehensive documentation demonstrating accountability. Key records include: Records of Processing Activities (RoPA / Verzeichnis von Verarbeitungstätigkeiten) under Article 30 GDPR; DPIA reports for high-risk processing; data processing agreements with all vendors and processors (Article 28); consent records with timestamps and audit trails; data breach notification records (Article 33); privacy notices and internal policies; DPO appointment documentation; and staff training records. During audits, the BfDI or state DPAs will request these documents. Incomplete or absent documentation is one of the most common — and easily avoidable — compliance failures in Germany.