Germany — International Data Transfers

Germany regulates international data transfers primarily under the EU General Data Protection Regulation (GDPR), with national supplementation by the Bundesdatenschutzgesetz (BDSG, Federal Data Protection Act). The GDPR applies directly across Germany by virtue of its EU regulation status (Art. 288 TFEU), establishing requirements for transfers of personal data to third countries or international organizations (see GDPR, Chapter V, Arts. 44–50). Every data export from Germany must comply with these provisions—data may only be transferred outside the European Economic Area (EEA) when the conditions of GDPR Chapter V are met.

The BDSG supplements the GDPR only in areas expressly allowed by the Regulation. For international transfers, such national supplementation in Germany is limited and primarily concerns specific public interest derogations (see BDSG § 1(1), § 4, and § 26(4) concerning employment data). BDSG does not create independent transfer mechanisms beyond those in the GDPR. Crucially, cross-border transfers from Germany are not subject to additional national authorization requirements unless a specific BDSG derogation applies.

Supervision and enforcement of international data transfers is carried out by Germany’s independent data protection authorities (DPAs)—the competent authority for most private entities is the state (Länder) supervisory authority. For federal public entities, the federal Commissioner for Data Protection and Freedom of Information (BfDI) is responsible.

In the event of a conflict, the GDPR provisions on international transfers take precedence. For detailed cross-border transfer mechanisms (e.g., adequacy, Standard Contractual Clauses, Binding Corporate Rules), practitioners should refer directly to GDPR Chapter V and guidance from the European Data Protection Board (EDPB). National differences arise largely in the application of public interest or sector-specific derogations.

Source: BDSG text, § 1, § 4, § 26(4) (in German) Source: GDPR text, Chapter V, Arts. 44–50 (in English)

The German supervisory authorities, led by the Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragter für den Datenschutz und die Informationsfreiheit, BfDI), have publicly aligned themselves with the European Data Protection Board (EDPB) approach to international transfers following the Court of Justice of the EU’s Schrems II (C-311/18) decision. Schrems II (16 July 2020) invalidated the EU-US Privacy Shield and clarified that Standard Contractual Clauses (SCCs) under Art. 46 GDPR remain valid only if the data exporter, prior to transfer, assesses the third-country legal system and—where needed—implements “supplementary measures” to ensure equivalent protection (GDPR Arts. 44, 46).

In immediate response to Schrems II, the BfDI confirmed its expectation (but not a new legal requirement) that organizations document Transfer Impact Assessments (TIAs) for non-adequacy transfers using SCCs or other mechanisms, and be able to show such analysis and any supplementary measures on request (see BfDI press release, 17 July 2020; BfDI Schrems II guidance). While the BfDI and many Länder authorities have issued guidance and warnings, there is no published decision as of 2024 where a German authority has formally blocked a data transfer solely for failure to perform such a TIA or to implement supplementary measures post-Schrems II. However, the BfDI and Länder DPAs have made clear—via public statements and detailed guidance—that they expect full documentation and may require organizations to produce this evidence during supervision or in complaint-driven investigations.

German practice is consistent with the EDPB Recommendations 1/2020, though the BfDI stresses high diligence and the risk of prohibition if an exporter cannot show protection is “essentially equivalent.” Organizations operating in or exporting from Germany should be prepared for detailed scrutiny of their transfers, especially to the United States, and should monitor the BfDI’s Schrems II guidance portal for updates (guidance has been updated multiple times since 2020).

Source: BfDI guidance on international data transfers Source: BfDI press release on Schrems II, 17 July 2020 Source: BfDI detailed Schrems II guidance

Germany recognizes and enforces the international data transfer mechanisms set out in Chapter V of the GDPR: adequacy decisions (Art. 45), Standard Contractual Clauses (SCCs, Art. 46(2)(c)), and Binding Corporate Rules (BCRs, Art. 47). These mechanisms are directly effective in Germany; national law does not impose additional general approval, but German data exporters face high diligence standards, and the supervisory authorities (primarily the state [Länder] DPAs and the Federal Commissioner for Data Protection and Freedom of Information, BfDI) expect rigorous documentation and practical compliance with these instruments.

1. Transfers on the basis of an adequacy decision (Art. 45 GDPR) The European Commission's adequacy decisions are directly recognized in Germany; no further national registration or notification is required before transferring personal data to an "adequate" country. The adequacy status of each country is maintained at EU level and binding across all Member States, including Germany (Art. 45(1) GDPR). Exporters should ensure the specific data flow falls under the scope of the adequacy decision as published by the Commission.

2. Standard Contractual Clauses (SCCs, Art. 46(2)(c) GDPR) German data exporters may use the SCCs adopted by the European Commission as a transfer tool for non-adequate jurisdictions (Art. 46(2)(c)-(d)). The BfDI and Länder DPAs require that these clauses are implemented in the unmodified form published by the Commission—inserting additional clauses is only permitted so long as they do not conflict with, or detract from, the level of protection of the SCCs. Following Schrems II, exporters must also conduct and document a Transfer Impact Assessment (TIA) and, where required, implement "supplementary measures" to ensure an essentially equivalent level of protection. German DPAs have repeatedly stated that failure to produce TIA documentation may expose the exporter to enforcement or prohibition orders (see BfDI Schrems II guidance; EDPB Recommendations 01/2020).

3. Binding Corporate Rules (BCRs, Art. 47 GDPR) BCRs are recognized as a valid transfer tool for intra-group transfers from Germany, but require prior approval by a competent DPA. In most cases, the competent authority is the DPA of the state in which the German group entity’s main establishment is located. The BfDI acts as federal lead authority only for federal public bodies. The BCR approval process follows EDPB and WP29 guidance and is coordinated at EU level, but German DPAs have a reputation for detailed review and require comprehensive supporting materials under Art. 47 GDPR. Once approved, BCRs are valid throughout Germany without further formalities.

Exporters must maintain records of their transfer mechanism(s), and must be able to provide relevant documentation upon request by any German DPA. It is critical to monitor both EDPB and BfDI/Länder guidance, as authorities may issue clarifying statements or sector-specific documentation expectations (especially post-Schrems II). For documentation and procedural specifics, refer to the BfDI international transfer page, which collects the binding rules, German-language practical guidance, and links to EU resources.

Source: BfDI international data transfers summary