EdLaw
Bayern — Bayerisches Datenschutzgesetz (BayDSG)
Bavaria's general data-protection act for public bodies, supplementing the GDPR for the authorities of the Free State, the municipalities and the other public-law bodies under state supervision — which includes Bavaria's public schools. The school-specific rules of the BayEUG (Art. 85, 85a) take precedence as special provisions (Art. 1(5)); the BayDSG fills in the rest: who the controller is, the general legal basis, transfers and maintenance access by outside bodies, shared automated procedures, special categories, the official DPO, DPIAs, the sanctions regime and video surveillance. Text as last amended by § 2 of the Act of 25 July 2025 (GVBl. S. 254), in force from 1 August 2025.
Statute text is German (authentic language); this README is curation.
Applicability to EdTech
- Scope and controller. The Act applies to the authorities and other public bodies of the Free State, the municipalities and the public-law bodies under state supervision (Art. 1(1)); private bodies exercising sovereign administrative tasks are treated as public bodies (Art. 1(4)). The controller in the GDPR sense is the public body competent for the processing unless otherwise provided (Art. 3(2)) — a public body, not the vendor.
- Remote maintenance and support are processing on behalf. Where other bodies test or maintain automated procedures or IT systems and access to personal data cannot be excluded, Art. 28(1)–(4), (9) and (10) GDPR apply accordingly; if the Art. 28(3) contract cannot be concluded in writing or electronically before the work, it must be made good without delay (Art. 5(3)). A vendor's support desk with access to a school tenant is inside this provision.
- Legal basis and collection. Processing by a public body is lawful where necessary for a task incumbent on it (Art. 4(1)); data is to be collected from the data subject with their knowledge, collection from third parties only in the listed cases (Art. 4(2)). Transfers to non-public bodies need a credibly shown legitimate interest and no overriding interest of the data subject, and the recipient is bound to the transfer purpose (Art. 5(1)).
- Shared and retrieval systems. Automated retrieval procedures and procedures letting several public bodies process one data set are allowed only on the conditions of Art. 7 — the provision that reaches a district- or state-wide platform.
- Special categories need appropriate and specific safeguards, which must be documented in the Art. 30 record (Art. 8(2)).
- DPO and DPIA. The official DPO must be given the opportunity to comment before an automated procedure is first used or substantially changed (Art. 12(1) Nr. 2). A DPIA can be omitted where the competent ministry (or a body it authorises) has already carried one out for a processing operation taken over essentially unchanged (Art. 14(1) Nr. 1), and a public body that develops a procedure for use by public bodies may carry out the DPIA for all of them (Art. 14(2)).
- Sanctions. No GDPR fines against public bodies except where they compete as undertakings (Art. 22). The offence in Art. 23(1) reaches anyone who without authorisation stores, alters, transfers, makes retrievable or retrieves non-public personal data processed by a public body — fine up to EUR 30,000; a crime if done for payment or to enrich or harm (Art. 23(2)); the processor is among those entitled to file the complaint.
- Video surveillance on public premises: lawful for the listed protective purposes (Art. 24(1)), signposted (Art. 24(2)), deleted at the latest two months after collection unless needed for the listed purposes (Art. 24(4)), and notified to the DPO in advance (Art. 24(5)).
- Not in the BayDSG: no provision on a consent age or on children.
Contents
| Document | Covers |
|---|---|
| BAYDSG.md | BayDSG Art. 1–8, 11, 12, 14, 22, 23, 24 in full |
Key obligations at a glance
- Outside maintenance with possible data access = Art. 28 GDPR terms, in writing (Art. 5(3)).
- DPO heard before a new or substantially changed automated procedure (Art. 12(1)).
- Special-category safeguards recorded in the Art. 30 record (Art. 8(2)).
- Video recordings deleted within two months (Art. 24(4)).
Enforcement
The Bayerischer Landesbeauftragter für den Datenschutz supervises public bodies (Art. 15 BayDSG, not carried; referred to in Art. 1(3)); no administrative fines against public bodies outside competition (Art. 22, Art. 23(3)); individual offences under Art. 23. The vendor's own processing as a non-public body answers to the DPA of its establishment under BDSG § 40.
Licence
The corpus reproduces fourteen articles of the Bayerisches Datenschutzgesetz in the consolidated version on BAYERN.RECHT.
German copyright law places statutes and ordinances outside copyright. § 5 Abs. 1 Urheberrechtsgesetz (gesetze-im-internet.de — UrhG § 5, read 2026-10-01) provides: "Gesetze, Verordnungen, amtliche Erlasse und Bekanntmachungen sowie Entscheidungen und amtlich verfaßte Leitsätze zu Entscheidungen genießen keinen urheberrechtlichen Schutz."
The corpus takes the text from BAYERN.RECHT, published by the Bayerische Staatskanzlei. Its Impressum (gesetze-bayern.de/Content/Document/Impressum, read 2026-10-01) names the Staatskanzlei as publisher and Verlag C.H.Beck as technical provider and contains no terms restricting reuse; no other terms of use were found on the portal.
Conditions: none attach to the statute text, because no copyright subsists in it. The corpus still identifies its source: the fact document names its source in each article's citation line and in its Meta section, and Sources here links the official text (BAYERN.RECHT). The changes (the selection of provisions, the Markdown layout and the added anchors) are described in Meta. The corpus does not claim that the publisher endorses it, and only the officially promulgated text is authentic.
Related
- BayEUG Datenschutz — the school-specific provisions, which take precedence (Art. 1(5))
- BDSG — the federal act for the vendor's own processing
- NDSG — Lower Saxony's counterpart
- EU GDPR