Directly applicable across Germany — full Article 5 principles, lawful bases, and data-subject rights.

Federal Data Protection Act — adapts the GDPR's opening clauses, including stricter employee data and DPO appointment thresholds.

Telecom and digital services privacy — cookie consent (§25), traffic data, and end-device access governance.

Each Federal State has its own DSG governing public-sector controllers; private-sector handled by 16 State DPAs.

Risk-based AI obligations enforced by the BfDI for federal authorities and by State DPAs for private actors.

Mandatory works council co-determination on any system that monitors employee performance or behaviour (§87).