EdLaw
Sachsen — Sächsisches Datenschutzdurchführungsgesetz (SächsDSDG)
Saxony's general data-protection act for public bodies, supplementing the GDPR for the authorities of the Free State, the municipalities and districts and the public-law bodies under state supervision — public schools included. The SächsSchulG defers to it expressly: data protection at public schools follows the GDPR and the SächsDSDG unless the SchulG provides otherwise (§ 63a(1) SächsSchulG), and special provisions of Land or federal law take precedence over it (§ 2(5)). This instrument carries the provisions that reach a school or its processor: scope, legal basis, purpose change, collection, transfers, staff data, video surveillance, the supervisory authority's powers and the sanctions. Text in the version valid from 1 January 2024 (last amended by Article 8(6) of the Act of 6 July 2023, SächsGVBl. S. 467).
Statute text is German (authentic language); this README is curation.
Applicability to EdTech
- Scope. The Act applies to processing within the GDPR's scope by the authorities and other public bodies of the Free State, the municipalities and districts and the public-law bodies under state supervision; non-public bodies exercising sovereign administrative tasks are public bodies to that extent (§ 2(1)).
- Legal basis — maintenance included. Processing is lawful where necessary for a task within the controller's competence or in the exercise of official authority (§ 3(1)); the purpose of a processing operation includes testing and maintaining automated procedures, supervision, audit and the controller's statistics, and training purposes unless the data subject's interests prevail (§ 3(2)). A vendor's maintenance access therefore does not change the purpose — but the vendor still acts as a processor under Art. 28 GDPR, which the SächsDSDG does not modify.
- Purpose change only in the listed cases (§ 4); collection and responsibility for transfers in § 5 and § 6.
- Video surveillance of publicly accessible areas only for a public-interest task or domestic authority (§ 13(1)), signposted with the controller's name and contact details (§ 13(3)), and deleted without delay, at the latest one month after collection, once no longer needed (§ 13(4)).
- Supervisor's powers and fines. The Sächsischer Datenschutzbeauftragter may enter offices at any time and access all IT systems and devices (§ 19(1)); he may impose fines on public bodies only where they compete as undertakings (§ 19(3)). Public bodies must inform him before issuing administrative regulations that affect informational self-determination (§ 20).
- Individual offences. Processing non-public personal data contrary to data-protection law, or obtaining a transfer by false statements, is an offence with a fine up to EUR 25,000 (§ 22(1)–(2)), and a crime when done for payment or with intent to enrich or harm (§ 22(4)) — provisions that reach individuals, a processor's staff included.
- Not in the SächsDSDG: no provision on processing on behalf and none on a consent age or on children. In Saxony the school-level rules on consent by minors are in the VwV Schuldatenschutz.
Contents
| Document | Covers |
|---|---|
| SAECHSDSDG.md | SächsDSDG §§ 1–6, 11, 13, 19, 20, 22 in full |
Key obligations at a glance
- Public-task basis; maintenance of automated procedures within the purpose (§ 3).
- Video recordings deleted within one month (§ 13(4)).
- No fines against schools (§ 19(3)); individual offences up to EUR 25,000 (§ 22(2)).
Enforcement
The Sächsischer Datenschutzbeauftragter supervises public bodies (§§ 14–21 SächsDSDG; powers in § 19) and is the administrative authority for the offences (§ 22(3)). The vendor's own processing answers to the DPA of its establishment under BDSG § 40.
Licence
The corpus reproduces eleven sections of the Sächsisches Datenschutzdurchführungsgesetz in the consolidated version on REVOSax.
German copyright law places statutes and ordinances outside copyright. § 5 Abs. 1 Urheberrechtsgesetz (gesetze-im-internet.de — UrhG § 5, read 2026-10-01) provides: "Gesetze, Verordnungen, amtliche Erlasse und Bekanntmachungen sowie Entscheidungen und amtlich verfaßte Leitsätze zu Entscheidungen genießen keinen urheberrechtlichen Schutz."
The corpus takes the text from REVOSax, the Freistaat Sachsen's portal. Its Impressum (revosax.sachsen.de/impressum, read 2026-10-01) contains a liability disclaimer and no terms restricting reuse.
Conditions: none attach to the statute text, because no copyright subsists in it. The corpus still identifies its source: the fact document names its source in each section's citation line and in its Meta section, and Sources here links the official text (REVOSax). The changes (the selection of provisions, the Markdown layout and the added anchors) are described in Meta. The corpus does not claim that the publisher endorses it, and only the officially promulgated text is authentic.
Related
- SächsSchulG Datenschutz — the school-specific provisions and the VwV Schuldatenschutz
- BDSG — the federal act for the vendor's own processing
- EU GDPR