EdLaw
Bundesdatenschutzgesetz (BDSG)
Germany's federal data-protection act (BDSG of 30 June 2017, BGBl. I 2017, 2097), applying alongside the GDPR since 25 May 2018. Germany's data-protection landscape is split: the BDSG governs federal public bodies and private ("nichtöffentliche") bodies; schools are public bodies of the Länder, governed by each Land's Landesdatenschutzgesetz and Schulgesetz (§ 1(1), § 2). For an EdTech vendor this means: the vendor's own processing sits under GDPR + BDSG; the school customer's processing sits under GDPR + Land law — both sides of one contract answer to different German statutes.
Fact documents in this folder are in German (the authentic text); this README is curation.
Applicability to EdTech
- The vendor is a "nichtöffentliche Stelle" (§ 2(4)); the BDSG applies to its wholly or partly automated processing (§ 1(1) sentence 2), with the extraterritorial reach in § 1(4).
- Supervision of private bodies is by the Land data-protection authorities (§ 40(1)) — the competent authority follows the establishment, so a German subsidiary's Land determines the regulator (the LfDI/LDA of that Land).
- Special-category data (health, biometrics — headset eye/interaction data can qualify) is governed by the § 22 opening clause to GDPR Art. 9, with mandatory "angemessene und spezifische Maßnahmen" under § 22(2).
- Employee data (teacher accounts processed as HR-adjacent data in B2B contexts) falls under § 26.
- Children's consent age: the BDSG contains no derogation from GDPR Art. 8(1), so the EU default of 16 applies in Germany for information-society services offered directly to a child — a key operational difference from the UK's 13. (Assertion of absence: checked against the full consolidated act, XML build 2026-07-13; the GDPR default is at Art. 8.)
- School-side rules (what a Schulleitung may lawfully hand to a vendor) live in the Länder instruments under state/, which covers all sixteen Länder
Contents
| Document | Covers |
|---|---|
| SCOPE-AND-DEFINITIONS.md | §§ 1–2 — Anwendungsbereich, Begriffsbestimmungen |
| PROCESSING-PROVISIONS.md | §§ 22, 26 — besondere Kategorien, Beschäftigtendaten |
| SUPERVISION.md | § 40 — Aufsichtsbehörden der Länder |
Scope note: the accreditation/certification, DPO (§§ 5–7, 38), video surveillance (§ 4), scoring (§ 31), penal (§§ 41–43) and Teil 3 (JI-Richtlinie) provisions can be added with the same tooling when needed.
Key obligations at a glance
- Special-category processing only within the § 22(1) grounds and with the § 22(2) safeguards catalogue (encryption, pseudonymisation, access restrictions, DPO involvement, …).
- Employee-context processing per § 26, including the consent-voluntariness factors in § 26(2).
Enforcement
Land data-protection authorities for private bodies (§ 40); GDPR Art. 83 fines apply directly (the BDSG's own §§ 41–43 add procedure and criminal provisions, not extracted). The BfDI supervises federal public bodies and telecoms — not the typical EdTech vendor.
Licence
The corpus reproduces provisions of the Bundesdatenschutzgesetz in the consolidated version on gesetze-im-internet.de.
German copyright law places statutes and ordinances outside copyright. § 5 Abs. 1 Urheberrechtsgesetz (gesetze-im-internet.de — UrhG § 5, read 2026-10-01) provides: "Gesetze, Verordnungen, amtliche Erlasse und Bekanntmachungen sowie Entscheidungen und amtlich verfaßte Leitsätze zu Entscheidungen genießen keinen urheberrechtlichen Schutz."
The corpus takes the text from gesetze-im-internet.de, the Bundesamt für Justiz's consolidation. Its notes (gesetze-im-internet.de/hinweise.html, read 2026-10-01) offer the norms for download, including as XML "für die Nutzer [...], die die hier zur Verfügung gestellten Gesetze und Rechtsverordnungen über automatisierte Verfahren weiterverarbeiten möchten", and contain no terms restricting reuse.
Conditions: none attach to the statute text, because no copyright subsists in it. The corpus still identifies its source: each fact document names its source in its opening citation line and in its Meta section, and Sources here links the official text (gesetze-im-internet.de). The changes (the selection of provisions, the Markdown layout and the added anchors) are described in Meta. The corpus does not claim that the publisher endorses it, and only the officially promulgated text is authentic.
Related
- EU GDPR — the BDSG concretises and supplements it; Art. 8's 16-year default applies unmodified in Germany
- Länder school/data-protection instruments — all sixteen Länder