Data protection at companies

Do you process personal data at your company? If so, then under certain circumstances you have data protection obligations (for example appointment of a data protection officer). The sections below explain which companies are affected by these rules and what specific measures you must take to ensure the security of personal data.

The supervision of data protection is shared by various authorities on a federal and state level, as data protection in Germany is a matter both for the federation and for the individual German states.

On a federal level (for federal authorities and other state institutions), the federal officer for data protection and freedom of information monitors compliance with the data protection regulations. The basis of this work is the German Federal Data Protection Act (Bundesdatenschutzgesetz).

On a state level, the state officer for data protection is the highest level supervisory authority for public and non-public bodies (for example companies). Data subjects can contact these bodies in case of queries or complaints, also if data protection breaches have taken place.

There are also church data protection officers for the respective church and the radio officer for data protection. Südwestrundfunk (SWR), the SWR subsidiary companies and ARD ZDF Deutschlandradio Beitragsservice are subject to their supervision, should SWR participants be affected.

Note: Companies who maintain their place of business in Baden-Württemberg are generally subject to the supervision of the state data protection officer. Postal and telecommunication companies are excluded from the above - the federal officer for data protection and information is responsible for them.