Federal Data Protection Act

Amendment and adaptation of the German Federal Data Protection Act and other laws


The Second Data Protection Adaptation and Implementation Act EU (2nd DSAnpUG-EU) entered into force on 26 November 2019 with its publication in the Federal Law Gazette (only available in German).

With this law, the legislator has adapted numerous laws (more than 150 in total) to the requirements of the DSGVO. These are predominantly

  • linguistic adaptations;
  • adaptations of legal bases for the respective data processing;
  • supplementary regulations on data subjects rights, and
  • other adaptations (such as specific technical and organisational measures, data processing agreements, or transfer to third countries).

Of the amendments, two in particular should be highlighted:

1. Designation of Data Protection Officer: increase from ten to twenty employees

Previously, controlers or processors had to designate a data protection officer in accordance with Sect. 38(1) of the BDSG (Federal Data Protection Act), provided that they normally employ at least ten persons to carry out automated processing on a permanent basis.

This number has now increased to twenty persons.

2. Electronic consent also possible in the employment context

Under Sect. 26(2) of the BDSG, employees no longer have to give their consent in writing, but can also give it electronically. (Please note that consents are generally delicate in the employment context.)

All changes are presented here in tabular form and are searchable.

A synopsis of the BDSG with all changes contained therein is available here.


contact person


Benjamin Stach, LL.M.
Taylor Wessing
Phone: +49 40 36803-0