Service provided by the Federal Ministry of Justice
and the Federal Office of Justice ‒ www.gesetze-im-internet.de
2.
personal data are processed in the context of the activities of an establishment
of the controller or processor in Germany, or if,
3.
although the controller or processor has no establishment in a Member State of
the European Union or another contracting state of the European Economic Area, it does
fall within the scope of Regulation (EU) 2016/679 of the European Parliament and the
Council of 27 April 2016 on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data, and repealing
Directive 95/46/EC (General Data Protection Regulation) (OJ L 119 of 4 May 2016, p. 1;
L 314 of 22 November 2016, p. 72; L 127 of 23 May 2018, p. 2) in the applicable version.
If this Act does not apply in accordance with the second sentence, only Sections 8 to 21 and
39 to 44 shall apply to the controller or processor.
(5) The provisions of this Act shall not apply where the law of the European Union, in
particular Regulation (EU) 2016/679 in the applicable version, directly applies.
(6) The contracting states of the European Economic Area shall have equal status with the
Member States of the European Union with regard to processing for purposes in accordance
with Article 2 of Regulation (EU) 2016/679. Other states shall be regarded as third countries.
(7) With regard to processing for purposes in accordance with Article 1 (1) of Directive (EU)
2016/680 of the European Parliament and the Council of 27 April 2016 on the protection of
natural persons with regard to the processing of personal data by competent authorities for
the purposes of the prevention, investigation, detection or prosecution of criminal offences or
the execution of criminal penalties, and on the free movement of such data, and repealing
Council Framework Decision 2008/977/JHA (OJ L 119 of 4 May 2016, p. 89), the states
associated with the implementation, application and development of the Schengen Acquis
shall have equal status with the Member States of the European Union. Other states shall be
regarded as third countries.
(8) Regulation (EU) 2016/679 and Parts 1 and 2 of this Act shall apply accordingly to
processing of personal data by public bodies in the context of activities outside the scope of
Regulation (EU) 2016/679 and Directive (EU) 2016/680 unless otherwise provided for in this
or another Act.
Section 2
Definitions
(1) Public bodies of the Federation are the authorities, judicial bodies and other public law
institutions of the Federation, of direct federal corporations, statutory bodies and foundations
established under public law and of their associations irrespective of their legal form.
(2) Public bodies of the Länder are the authorities, judicial bodies and other public law
institutions of a Land, a municipality, an association of municipalities or of other legal
persons under public law subject to Land supervision and of their associations irrespective of
their legal form.
(3) Associations of public bodies of the Federation and the Länder which are established
under private law and perform tasks of public administration shall be regarded as public
bodies of the Federation irrespective of the participation of private bodies if
1.
they operate beyond the borders of a Land, or
2.
the Federation holds the absolute majority of shares or controls the absolute
majority of votes.
Otherwise they shall be regarded as public bodies of the Länder.
(4) Private bodies are natural and legal persons, societies and other associations
established under private law unless they are covered by subsections 1 to 3. If a private
body performs sovereign tasks of the public administration, it shall be a public body as
defined in this Act.
(5) Public bodies of the Federation shall be regarded as private bodies as defined in this Act
if they take part in competition as enterprises governed by public law. Public bodies of the
Page 2 of 43