Bernd Schütze

Data Protection Acts of the Federal States adapted to the GDPR

About four weeks after the GDPR entered into force, the State Data Protection Acts of the German Federal States were adapted and the regulations of the specific states entered into force. In some Federal States regulations other than the specific State Data Protection Act were also adapted already, although further adaptations were of course needed in every Federal State.

The overview below contains the URLs for the State laws; where available, links to the Law and Ordinance Gazettes of each Federal State are also given:

  1. Baden-Württemberg:
    State Data Protection Act (LDSG)
    Law Gazette for Baden-Württemberg dated 20 June 2018
  2. Bavaria:
    Bavarian Data Protection Act(BayDSG)
    Bavarian Law and Ordinance Gazette dated 15 May 2018
  3. Berlin:
    Law on the protection of personal data in the Berlin administration (Berlin Data Protection Act – BlnDSG)
    Berlin Law and Ordinance Gazettedated 23 June 2018
  4. Brandenburg:
    Law on the protection of personal data in the State of Brandenburg (Brandenburg Data Protection Act – BbgDSG)
    Law and Ordinance Gazette for the State of Brandenburg dated 8 May 2018
  5. Bremen:
    Bremen Act on the implementation of the EU General Data Protection Regulation(BremDSGVOAG)
    Bremen Law Gazette dated 11 May 2018
  6. Hamburg:
    Hamburg Data Protection Act (HmbDSG)
    Hamburg Law and Ordinance Gazette dated 24 May 2018
  7. Hesse:
    Hessian Data Protection and Freedom of Information Act (HDSIG)
    Law and Ordinance Gazette for the State of Hesse dated 9 May 2018
  8. Mecklenburg-West Pomerania:
    Data Protection Act for the State of Mecklenburg-West Pomerania (State Data Protection Act – DSG M-V)
    Law and Ordinance Gazette for Mecklenburg-West Pomerania dated 22 May 2018
  9. Lower Saxony
    Lower Saxony Data Protection Act(NDSG)
    Lower Saxony Law and Ordinance Gazette dated 16 May 2018
  1. Saxony:
    Saxon Data Protection Implementation Act
    Saxon Law and Ordinance Gazettedated 24 May 2018 (Note: SächsGVBl available at a fee, for the law for adaptation see REVOSax)
  2. Saxony-Anhalt:
    Law on the protection of personal data of citizens (Data Protection Act Saxony-Anhalt – DSG LSA)
    Law and Ordinance Gazette for the State of Saxony-Anhalt Page 10 (Note: The Law and Ordinance Gazette for the State of Saxony-Anhalt is not available online.=


The future will show to what extent specific State laws comply with GDPR specifications and requirements. The following was agreed under the Treaty of Lisbon (Section C 83/344, Chapter 17, Official Journal of the European Union dated 30 March 2010):

“The Conference points out that the treaties and laws based on the treaties and enacted by the Union are consistent with established jurisdiction of the European Union court of justice under the conditions stipulated in this case and will take precedence over the laws of member states.” The GDPR thus takes precedence over State laws, i.e. the GDPR shall be applied in case of conflict between national and European law. Practice will here need to demonstrate the extent to which specific state laws comply with the European regulations, i.e. whether changes to some laws are still needed.

Author: Dr. Bernd Schütze


Leave a Reply

Your email address will not be published. Required fields are marked *