Laws & Regulations

The GDPR applies to any organization that processes the personal data of EU residents, regardless of where the organization is based. It establishes rights for data subjects and obligations for controllers and processors, including documentation requirements, security measures, data subject rights, breach notification, and in some cases appointment of a Data Protection Officer.

The BDSG implements and supplements GDPR in Germany. It governs specific areas where member states retain discretion, including employee data protection, data protection in public authority contexts, and the specifics of DPO appointment thresholds in Germany (20+ persons regularly processing personal data).

NIS2 dramatically expands the scope of mandatory cybersecurity requirements across the EU compared to the original NIS Directive. It covers "essential" and "important" entities across 18 sectors (including energy, transport, health, banking, digital infrastructure, manufacturing, food, and public administration). Obligations include risk management measures, incident reporting (within 24/72 hours), supply chain security, and management accountability. Germany transposed NIS2 into the NIS2UmsuCG.

The EU AI Act establishes a risk-based framework for AI systems, classifying them as unacceptable risk (prohibited), high risk (stringent requirements), limited risk (transparency obligations), or minimal risk (no specific requirements). High-risk AI applications in employment, education, healthcare, law enforcement, and critical infrastructure face significant documentation, transparency, and conformity assessment requirements. Organizations using AI tools — including off-the-shelf solutions — may have compliance obligations.

Currently implemented in Germany through the TTDSG (Telekommunikation-Telemedien-Datenschutz-Gesetz). Requires informed consent for non-essential cookies and governs direct electronic marketing (including email newsletters and SMS). The long-anticipated ePrivacy Regulation to replace the Directive remains in negotiation.