Germany — International Data Transfers

Germany regulates international data transfers primarily under the EU General Data Protection Regulation (GDPR), with national supplementation by the Bundesdatenschutzgesetz (BDSG, Federal Data Protection Act). The GDPR applies directly across Germany by virtue of its EU regulation status (Art. 288 TFEU), establishing requirements for transfers of personal data to third countries or international organizations (see GDPR, Chapter V, Arts. 44–50). Every data export from Germany must comply with these provisions—data may only be transferred outside the European Economic Area (EEA) when the conditions of GDPR Chapter V are met.

The BDSG supplements the GDPR only in areas expressly allowed by the Regulation. For international transfers, such national supplementation in Germany is limited and primarily concerns specific public interest derogations (see BDSG § 1(1), § 4, and § 26(4) concerning employment data). BDSG does not create independent transfer mechanisms beyond those in the GDPR. Crucially, cross-border transfers from Germany are not subject to additional national authorization requirements unless a specific BDSG derogation applies.

Supervision and enforcement of international data transfers is carried out by Germany’s independent data protection authorities (DPAs)—the competent authority for most private entities is the state (Länder) supervisory authority. For federal public entities, the federal Commissioner for Data Protection and Freedom of Information (BfDI) is responsible.

In the event of a conflict, the GDPR provisions on international transfers take precedence. For detailed cross-border transfer mechanisms (e.g., adequacy, Standard Contractual Clauses, Binding Corporate Rules), practitioners should refer directly to GDPR Chapter V and guidance from the European Data Protection Board (EDPB). National differences arise largely in the application of public interest or sector-specific derogations.

Source: BDSG text, § 1, § 4, § 26(4) (in German) Source: GDPR text, Chapter V, Arts. 44–50 (in English)

The German supervisory authorities, led by the Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragter für den Datenschutz und die Informationsfreiheit, BfDI), have publicly aligned themselves with the European Data Protection Board (EDPB) approach to international transfers following the Court of Justice of the EU’s Schrems II (C-311/18) decision. Schrems II (16 July 2020) invalidated the EU-US Privacy Shield and clarified that Standard Contractual Clauses (SCCs) under Art. 46 GDPR remain valid only if the data exporter, prior to transfer, assesses the third-country legal system and—where needed—implements “supplementary measures” to ensure equivalent protection (GDPR Arts. 44, 46).

In immediate response to Schrems II, the BfDI confirmed its expectation (but not a new legal requirement) that organizations document Transfer Impact Assessments (TIAs) for non-adequacy transfers using SCCs or other mechanisms, and be able to show such analysis and any supplementary measures on request (see BfDI press release, 17 July 2020; BfDI Schrems II guidance). While the BfDI and many Länder authorities have issued guidance and warnings, there is no published decision as of 2024 where a German authority has formally blocked a data transfer solely for failure to perform such a TIA or to implement supplementary measures post-Schrems II. However, the BfDI and Länder DPAs have made clear—via public statements and detailed guidance—that they expect full documentation and may require organizations to produce this evidence during supervision or in complaint-driven investigations.

German practice is consistent with the EDPB Recommendations 1/2020, though the BfDI stresses high diligence and the risk of prohibition if an exporter cannot show protection is “essentially equivalent.” Organizations operating in or exporting from Germany should be prepared for detailed scrutiny of their transfers, especially to the United States, and should monitor the BfDI’s Schrems II guidance portal for updates (guidance has been updated multiple times since 2020).

Source: BfDI guidance on international data transfers Source: BfDI press release on Schrems II, 17 July 2020 Source: BfDI detailed Schrems II guidance

Germany recognizes and enforces the international data transfer mechanisms set out in Chapter V of the GDPR: adequacy decisions (Art. 45), Standard Contractual Clauses (SCCs, Art. 46(2)(c)), and Binding Corporate Rules (BCRs, Art. 47). These mechanisms are directly effective in Germany; national law does not impose additional general approval, but German data exporters face high diligence standards, and the supervisory authorities (primarily the state [Länder] DPAs and the Federal Commissioner for Data Protection and Freedom of Information, BfDI) expect rigorous documentation and practical compliance with these instruments.

1. Transfers on the basis of an adequacy decision (Art. 45 GDPR) The European Commission's adequacy decisions are directly recognized in Germany; no further national registration or notification is required before transferring personal data to an "adequate" country. The adequacy status of each country is maintained at EU level and binding across all Member States, including Germany (Art. 45(1) GDPR). Exporters should ensure the specific data flow falls under the scope of the adequacy decision as published by the Commission.

2. Standard Contractual Clauses (SCCs, Art. 46(2)(c) GDPR) German data exporters may use the SCCs adopted by the European Commission as a transfer tool for non-adequate jurisdictions (Art. 46(2)(c)-(d)). The BfDI and Länder DPAs require that these clauses are implemented in the unmodified form published by the Commission—inserting additional clauses is only permitted so long as they do not conflict with, or detract from, the level of protection of the SCCs. Following Schrems II, exporters must also conduct and document a Transfer Impact Assessment (TIA) and, where required, implement "supplementary measures" to ensure an essentially equivalent level of protection. German DPAs have repeatedly stated that failure to produce TIA documentation may expose the exporter to enforcement or prohibition orders (see BfDI Schrems II guidance; EDPB Recommendations 01/2020).

3. Binding Corporate Rules (BCRs, Art. 47 GDPR) BCRs are recognized as a valid transfer tool for intra-group transfers from Germany, but require prior approval by a competent DPA. In most cases, the competent authority is the DPA of the state in which the German group entity’s main establishment is located. The BfDI acts as federal lead authority only for federal public bodies. The BCR approval process follows EDPB and WP29 guidance and is coordinated at EU level, but German DPAs have a reputation for detailed review and require comprehensive supporting materials under Art. 47 GDPR. Once approved, BCRs are valid throughout Germany without further formalities.

Exporters must maintain records of their transfer mechanism(s), and must be able to provide relevant documentation upon request by any German DPA. It is critical to monitor both EDPB and BfDI/Länder guidance, as authorities may issue clarifying statements or sector-specific documentation expectations (especially post-Schrems II). For documentation and procedural specifics, refer to the BfDI international transfer page, which collects the binding rules, German-language practical guidance, and links to EU resources.

Source: BfDI international data transfers summary

Germany's supervisory authorities, led by the Federal Commissioner for Data Protection and Freedom of Information (BfDI) and the joint body of the Länder data protection authorities (DSK), have issued specific guidance on the use of the EU-US Data Privacy Framework (DPF) by German data exporters. The European Commission adopted its adequacy decision on 10 July 2023 (Commission Implementing Decision (EU) 2023/1795), allowing transfers of personal data from the EU—including Germany—to certified US entities under the DPF without the need for additional transfer safeguards (such as Standard Contractual Clauses).

Key German-specific expectations:

• The BfDI and DSK confirm that German organizations may rely on the DPF, provided that the recipient is actively certified under the DPF, and their certification is current and encompasses the relevant data processing activities. Exporters are expected to check certification status using the US Department of Commerce's DPF List (linked in BfDI materials). The BfDI expressly warns that transfers to non-participating US entities remain subject to Chapter V GDPR safeguards (e.g., SCCs plus a Schrems II–compliant risk assessment).
• The BfDI emphasizes that transfers to US intelligence or law enforcement agencies are excluded from the DPF's coverage and require separate scrutiny under GDPR and German law.
• On complaints, the BfDI has published detailed guidance for affected individuals: Data subjects in Germany may submit a complaint regarding suspected violations of their DPF-based protections to their competent German DPA, which will then coordinate with the US redress mechanism provided for in Executive Order 14086. The BfDI highlights practical experience to date, encouraging full documentation by exporters and timely responses to any official request for evidence of DPF reliance.

Supervisory and enforcement practice: The BfDI states it continues to monitor the DPF's implementation and has not, as of mid-2024, published enforcement action applying the DPF adequacy directly. However, German DPAs regularly scrutinize the scope and substance of adequacy reliance—particularly in audits or complaint investigations, with strict expectations for exporter diligence.

For further DPF updates, exporters should closely follow the BfDI and DSK guidance portals and the European Commission’s official adequacy register.

Source: BfDI press release on DPF adequacy decision, 10 July 2023 Source: BfDI FAQ for companies on the DPF, 7 August 2024 Source: BfDI complaint process guidance, 18 June 2024

Germany’s Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG; version effective 20 November 2019) sets out limited sectoral and public interest derogations for international data transfers not covered by the standard mechanisms of Chapter V GDPR. These operate in specifically delimited spheres—primarily law enforcement, certain public authorities, and employment relationships—and must be read in alignment with GDPR and EU Directive 2016/680 (for law enforcement data).

1. Law enforcement and public authorities — § 1(8), § 4 BDSG Section 1(8) BDSG clarifies that, in areas outside the scope of the GDPR—most notably law enforcement and public security—processing and transfer of personal data are governed by the BDSG’s own rules and Directive (EU) 2016/680. Section 4 BDSG states that public bodies may transfer personal data to third countries if “permitted by law or by an international agreement,” or, where not possible, when necessary to protect the vital interests of the data subject or another person, and if data subject rights and interests do not override. These sections do not apply to purely private-sector processing.

2. Employment-specific derogations — § 26(4) BDSG For international transfers of employee data, § 26(4) BDSG states: "The transfer of personal data to third countries or to international organisations is permitted if the requirements of subsection (1) or another legal provision are met and the European Commission has not made an adequacy decision," and, where there is no adequacy decision, “if it is necessary to establish, perform or terminate the employment relationship,” provided that “there is no reason to assume that the data subject’s legitimate interest in excluding the transfer overrides.” This provision is often supplemented by terms in collective agreements or works council arrangements, but cannot be invoked where GDPR provides a higher standard.

3. No general private-sector derogation For most private-sector actors, the BDSG offers no independent transfer mechanisms: GDPR Chapter V remains controlling, and any derogation outside of employment or the explicit public-interest sectors above must be narrowly interpreted and justified, with strict documentation. There is no additional Länder-level transfer regime stated in the BDSG text.

Practical use and supervision German supervisory authorities (primarily the Länder DPAs and the federal BfDI) expect reliance on these BDSG derogations to be documented and invoked only as last-resort, case-specific solutions.

Source: BDSG text, § 1, § 4, § 26(4)