GDPR & BDSG Web Scraping Compliance: A 2026 Guide for German Businesses

Introduction

Germany has the strictest practical data protection enforcement environment in Europe. On top of EU GDPR sits the Bundesdatenschutzgesetz (BDSG) — Germany's national data protection law — plus 16 state data protection authorities (Landesdatenschutzbehörden) known for rigorous enforcement. For any German business running web-scraping operations, understanding this dual GDPR + BDSG framework is essential. This guide breaks it down for scraping operations specifically.

The GDPR + BDSG Dual Framework

German businesses operate under two layers of data protection law. EU GDPR provides the overarching framework — lawful basis, data subject rights, accountability. The BDSG implements GDPR in German law and adds Germany-specific provisions, particularly around employee data, video surveillance, and certain processing operations. Where GDPR allows member states discretion, the BDSG fills in — and Germany typically fills in strictly.

Germany's Decentralised Enforcement

Unlike most EU countries with a single data protection authority, Germany has 16 state-level authorities plus a federal one. Each German Bundesland has its own Landesdatenschutzbehörde. These authorities are well-resourced, active, and have historically taken assertive positions on web scraping. Operating in Germany means potentially answering to multiple authorities depending on where you and the data subjects are located.

What Counts as 'Personal Data'?

GDPR's definition applies — any information relating to an identified or identifiable natural person. For scraping operations: names, emails, phone numbers, IP addresses (German authorities have taken a broad view here), and any data linkable to individuals. German authorities have consistently held that publicly-available personal data is still personal data — being on a public website does not exempt it from GDPR/BDSG.

Lawful Basis for Scraping

GDPR requires a lawful basis. Consent is impractical for scraping. The realistic option for most B2B scraping is legitimate interests (Article 6(1)(f) GDPR). German authorities scrutinise legitimate interests claims carefully — you need a documented three-part assessment: a genuine legitimate purpose, processing that is necessary for it, and a balancing test confirming the individual's interests don't override yours. This documented assessment (Interessenabwägung) is the foundational compliance document for any German scraping operation.

Practical GDPR + BDSG Compliance for Web Scraping

1. Document Your Legitimate Interests Assessment

Before scraping, complete a thorough Interessenabwägung. German authorities ask for this first. Generic or perfunctory assessments don't withstand scrutiny.

2. Publish a Privacy Notice (Datenschutzerklärung)

Under GDPR Article 14, when you collect personal data from sources other than the data subject, you must provide information about the processing. German practice expects a thorough, clearly written Datenschutzerklärung.

3. Honour Data Subject Rights

German residents have full GDPR rights — access, rectification, erasure, restriction, objection. German data subjects are among Europe's most aware of and active in exercising these rights. You need robust processes to handle requests within one month.

4. Apply Strict Data Minimisation (Datensparsamkeit)

German data protection culture emphasises Datensparsamkeit — data economy/minimisation — strongly. Only scrape personal data you genuinely need. German authorities view excessive collection as a violation in itself.

5. Conduct a DPIA Where Required

Large-scale systematic monitoring or processing typically requires a Data Protection Impact Assessment (Datenschutz-Folgenabschätzung). German authorities publish lists of processing operations that mandate a DPIA.

6. Appoint a Data Protection Officer

The BDSG has a notably broad DPO requirement — German companies must appoint a Datenschutzbeauftragter if they have a certain number of employees regularly processing personal data, a lower threshold than many EU countries.

The Employee Data Dimension

If your scraping touches anything related to employee or recruitment data, the BDSG's Section 26 (employee data protection) applies — and it's strict. Scraping LinkedIn-style professional profiles, recruitment data, or any employment-related personal data warrants particular care under German law.

Common Myths

• Myth: 'Public data is exempt from GDPR/BDSG.' Reality: German authorities firmly reject this — public personal data is still personal data.
• Myth: 'We only need to satisfy one German authority.' Reality: Depending on your operations, multiple Landesdatenschutzbehörden may have jurisdiction.
• Myth: 'BDSG is just GDPR with a German name.' Reality: BDSG adds substantive German-specific provisions, particularly on employee data and DPO requirements.

How Actowiz Approaches German Compliance

For German clients, Actowiz Solutions builds scraping pipelines with the GDPR + BDSG framework baked in: documented Interessenabwägung per project, strict Datensparsamkeit, client-facing compliance documentation suitable for German authority scrutiny and ISO 27001 audits, and managed data-subject-rights processes.

Frequently Asked Questions

What are GDPR/BDSG penalties?

GDPR penalties of up to €20M or 4% of global annual turnover apply. German authorities have shown willingness to impose substantial fines. Civil claims by affected individuals are also increasingly common in German courts.

Do we need a DPO for web scraping operations?

Likely yes — the BDSG's DPO threshold is broad, and large-scale systematic monitoring (which scraping often is) is a strong indicator that a DPO is required.

Can we scrape data of non-German EU residents from Germany?

GDPR applies uniformly across the EU, but the BDSG specifically applies to German processing. Multi-country EU scraping requires careful attention to which national rules layer onto GDPR.