GDPR authority in Germany
Die Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) is the authority that supervises the GDPR in Germany.
Federal Commissioner for Data Protection and Freedom of Information
Official website: https://www.bfdi.bund.de/
Germany also has data protection authorities in each federal state. Most companies are supervised by the authority in their state, the federal commissioner mainly supervises federal bodies, telecoms and postal services.
What the authority does under the GDPR
- Monitors and enforces the GDPR in the country (Articles 51 and 57).
- Handles complaints from people whose personal data is processed (Article 77).
- Can order changes, ban processing and impose fines (Article 58 and Article 83).
- Acts as lead authority when a company's main establishment in the EU is in the country (Article 56).
Questions and answers
- Who do I complain to about the GDPR in Germany?
- Die Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI). You may also complain in the country where you live or work, or where the breach took place (Article 77).
- Can Die Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) fine a company?
- Yes. The authority can impose administrative fines of up to 20 million euro or 4 % of global annual turnover, whichever is higher (Article 83).
- What if the company is based in another EU country?
- The authority where the company has its main establishment leads the case, and cooperates with the others (Article 56).
Read the GDPR article by article · Population of Germany (Eurostat)
Authorities in other countries
| Country | Authority |
|---|---|
| Austria | Datenschutzbehörde |
| Belgium | Belgian Data Protection Authority |
| Bulgaria | Commission for Personal Data Protection |
| Croatia | AZOP |
| Cyprus | Commissioner for Personal Data Protection |
| Czechia | Úřad pro ochranu osobních údajů |
| Denmark | Datatilsynet |
| Estonia | Andmekaitse Inspektsioon |
| Finland | Tietosuojavaltuutetun toimisto |
| France | CNIL |
| Greece | Hellenic Data Protection Authority |
| Hungary | NAIH |
| Ireland | Data Protection Commission |
| Italy | Italian Data Protection Authority |
| Latvia | Datu valsts inspekcija |
| Lithuania | State Data Protection Inspectorate |
| Luxembourg | CNPD |
| Malta | Information and Data Protection Commissioner |
| Netherlands | Autoriteit Persoonsgegevens |
| Poland | UODO |
| Portugal | CNPD |
| Romania | National Supervisory Authority for Personal Data Processing |
| Slovakia | Office for Personal Data Protection of the Slovak Republic |
| Slovenia | Informacijski pooblaščenec |
| Spain | AEPD |
| Sweden | IMY |
| Norway | Datatilsynet |
Source: EDPB member list and Regulation (EU) 2016/679. Reviewed 2026-10-12.
ExploreWorldAI is operated by Valkiv Ventures AB (Reg. no. 556995-1311), Kungsgatan 8, 111 43 Stockholm, Sweden. EU-hosted, with data processing assessed against the GDPR. Contact: hello@exploreworldai.com.
Machine-readable summaries for AI agents: /llms.txt and /llms-full.txt.
