Data protection is regulated in the GDPR and in the Federal Data Protection Act (BDSG).

In addition to GDPR and BDSG, which is applied to the non-public sector, which means companies, the Federal Data Protection Act exist in Germany in addition to GDPR. Federal state data protection laws apply to the public sector (public authorities, schools, etc.) of the federal states, and data protection laws of the Churches, applicable to the organizations of the particular church are in place. As in the BDSG, they make use of the opening clauses GDPR has and coordinates them with the organizational structure of the respective federal states or church organizations.