EU Data Act Guide
  1. Home
  2. Member States
  3. The Data Act in Germany

Member States

The Data Act in Germany: The DADG, the Bundesnetzagentur, the BfDI and the § 15 Fine Catalogue

Germany applies the Data Act through the DADG (BGBl. 2026 I Nr. 157), in force since 30 May 2026: Bundesnetzagentur, BfDI, § 15 fine tiers, complaints.

Last updated 5 November 2026 · By the EU Data Act Guide Editorial Team · How statements are checked · Print this page

Summary

As of 5 November 2026, Germany applies the Data Act through the Datenverordnung-Anwendungs-und-Durchsetzungs-Gesetz (DADG), Article 1 of the law of 26 May 2026 (BGBl. 2026 I Nr. 157), in force since 30 May 2026, with the Bundesnetzagentur as the sole competent authority and the Federal Commissioner for Data Protection and Freedom of Information (BfDI) as the authority for personal data at non-public bodies.

The top German fine tier, EUR 5,000,000 or 2 % of worldwide total turnover for legal persons with total turnover above EUR 250 million, applies only to gatekeeper breaches of Article 5(3).

The Data Act, Regulation (EU) 2023/2854, entered into force on 11 January 2024 and has applied directly since 12 September 2025 (Art. 50). The EU Data Act sets the obligations; the DADG decides who enforces them in Germany and at what fine levels.

Key figures as of 5 November 2026:

  • In force: since 30 May 2026.
  • Authority: Bundesnetzagentur, the only one (§ 2(1) DADG).
  • Personal data: BfDI for non-public bodies (§ 3(1)).
  • Fines: EUR 50,000, 100,000 or 500,000 by offence; EUR 5,000,000, or 2 % of turnover above EUR 250 million, for Article 5(3) gatekeeper breaches (§ 15(4), (5)).
  • Data coordinator: none (single authority).

Germany's Implementation Act: Status as of 5 November 2026

As of 5 November 2026, the DADG has been in force since 30 May 2026 with no amendment found, which ends a period from 12 September 2025 to 29 May 2026 in which Germany had no competent authority and no penalty rules for the Data Act. The key dates come from the Official Journal, the Federal Law Gazette and the Bundestag.

Date Event (Data Act timeline) Basis
11 January 2024 Data Act enters into force Art. 50 Regulation (EU) 2023/2854
12 September 2025 Data Act applies; penalty rules due to the Commission Art. 50; Art. 40(2)
12 September 2025 to 29 May 2026 No German authority and no German penalty law no national act in force
26 March 2026 Bundestag adopts the act BT-Drs. 21/4998
26 May 2026 and 29 May 2026 Signature (Ausfertigung) and promulgation BGBl. 2026 I Nr. 157
30 May 2026 DADG in force; Bundesnetzagentur competent Art. 3 of the law; § 2(1) DADG
12 September 2026 Data access by design for connected products and related services placed on the market after this date Art. 3(1), Art. 50
12 January 2027 No switching charges from this date Art. 29(1)
12 September 2027 Art. 13 extends to older contracts of indefinite duration or expiring at least 10 years from 11 January 2024 Art. 50
2028 at the latest; 12 September 2028 Evaluation of the German authority structure requested by the Bundestag; Commission evaluation BT-Drs. 21/4998; Art. 49

The DADG: Official Title, Gazette Reference and Structure

The act's full title is the Gesetz zur Anwendung und Durchsetzung der Datenverordnung (Act on the Application and Enforcement of the Data Regulation), with the short title Datenverordnung-Anwendungs-und-Durchsetzungs-Gesetz and the official abbreviation DADG, and it forms Article 1 of a law dated 26 May 2026. That law, the Gesetz zur Durchführung der Verordnung (EU) 2023/2854, has three articles: Article 1 is the DADG (§§ 1 to 16), Article 2 amends the Urheberrechtsgesetz (Copyright Act), and Article 3 sets entry into force for the day after promulgation.

Promulgation in BGBl. 2026 I Nr. 157 followed on 29 May 2026; the current text is published as the DADG on gesetze-im-internet.de. § 1 DADG calls the Data Act the "Datenverordnung", its official German short title. The law is an Einspruchsgesetz (the Bundesrat can only object), led by the Bundesministerium für Digitales und Staatsmodernisierung (federal digital ministry).

How the German Act Was Adopted

The draft bill of 5 February 2025 was called the Data Act-Durchführungsgesetz (DA-DG); the cabinet adopted the government bill on 29 October 2025 and the Bundestag passed it on 26 March 2026. The bill (BT-Drs. 21/2998, 1 December 2025) drew a Bundesrat opinion on 19 December 2025 and a committee report (BT-Drs. 21/4998) on 25 March 2026, whose recommendation CDU/CSU and SPD supported, AfD opposed, and Bündnis 90/Die Grünen and Die Linke abstained on. On 8 May 2026 the Bundesrat let it pass without the mediation committee.

The Bundestag asked for an evaluation of the national authority structure by 2028 at the latest. The bill put the compliance cost for business at none and the federal cost at about EUR 4,200,000 a year.

The Bundesnetzagentur as Germany's Single Authority

The Bundesnetzagentur (Federal Network Agency) is Germany's competent authority for the application and enforcement of the Data Act under Article 37(1) (§ 2(1) DADG), and it is the only one, as of 5 November 2026. That single role covers every chapter, the Chapter VI switching rules included. The EU model of competent authorities, data coordinators and complaints is set out under Data Act enforcement.

Tasks of the Bundesnetzagentur in Germany

§ 2(2) DADG gives the Bundesnetzagentur eight tasks, from acting as the zentrale Anlaufstelle (single point of contact) to examining public-sector data requests of federal bodies. The eight tasks and their Data Act basis are compared below.

No. Task Data Act basis
1 Single point of contact, complaints, national supervision Art. 37(6)(a), Art. 38
2 Annual report to the Commission on refusals Art. 4(2), 4(8), 5(11); Art. 37(6)(c)
3 Certifying dispute settlement bodies Art. 10(5)
4 Publishing Chapter V requests Art. 17(2)(g), Art. 37(6)(b)
5 Information for the Commission's evaluation Art. 49
6 and 7 Promoting voluntary B2G agreements and research data sharing Art. 21
8 Examining Chapter V requests of federal public bodies (Länder bodies: Land law) Art. 37(5)(j)

Why Germany Has No Separate Data Coordinator

Germany designated no data coordinator because a coordinator is required only where a Member State designates more than one competent authority (Art. 37(2)); the Bundesnetzagentur takes over the coordinator's tasks (recital 107). The government bill explains this choice in its reasoning on § 2(1).

Cooperation with Sector Authorities in Germany

Where a final decision under Article 37(5)(b) or (j) touches a special sectoral matter, the Bundesnetzagentur takes it im Benehmen (in consultation) with the affected higher federal authority (§ 4(2) DADG). The government bill names the Kraftfahrt-Bundesamt (Federal Motor Transport Authority) for vehicle data, the Bundesamt für Sicherheit in der Informationstechnik (Federal Office for Information Security), and the Bundeskartellamt (Federal Cartel Office) for product-market questions (§ 50f GWB).

The BfDI's Role for Personal Data in Germany

For personal data, the Data Act in Germany is supervised by the BfDI for all non-public bodies, by derogation from § 40(1) BDSG, which would otherwise assign companies to the Länder data protection authorities (§ 3(1) DADG, as of 5 November 2026). Article 37(3) makes the GDPR supervisory authorities competent for personal data. The Bundesrat asked for the BfDI and the Länder authorities to share this competence; the request was not adopted.

The BfDI's assessment of whether processing is lawful binds the Bundesnetzagentur, can be challenged only with the final decision, and brings the BfDI into court proceedings (§ 3(5)). The BfDI also imposes the Article 40(4) fines, up to the Article 83(5) GDPR amounts for Chapters II, III and V only (§ 16).

Public bodies split differently: the BfDI supervises federal public bodies and the Länder authorities supervise Länder bodies. The Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD) confirmed its competence for public bodies in Schleswig-Holstein on 16 June 2026. The EU rule is explained under how the Data Act and the GDPR interact on personal data.

Fines under § 15 DADG: Four Tiers and the Turnover Rule

§ 15(4) DADG sets four maximum fines by offence, EUR 50,000, EUR 100,000, EUR 500,000 and EUR 5,000,000, and only the top tier for gatekeepers rises to 2 % of worldwide total turnover for legal persons with total turnover above EUR 250 million (§ 15(5)). The offences refer to the Data Act "in der Fassung vom 13. Dezember 2023" (in the version of 13 December 2023), a static reference.

The tiers below, taken from § 15 DADG, apply to intentional breaches; the Data Act itself sets no EU amount (Art. 40(1)).

Maximum Offences (§ 15 DADG) Data Act obligation
EUR 5,000,000; 2 % of worldwide total turnover for legal persons with total turnover above EUR 250 million § 15(2) No. 9 Gatekeeper solicits or incentivises sharing, Art. 5(3)(a), (b) (gatekeeper exclusion)
EUR 500,000 § 15(1) No. 2; § 15(2) Nos. 1, 2, 6, 7, 12, 13 Enforceable order; Art. 3(1); Art. 4(1), 5(1) (user's right to access data); Art. 4(10); Art. 4(13) second sentence, 5(6); Art. 6(2)(c), (d), (e)
EUR 100,000 § 15(1) No. 1; § 15(2) Nos. 8, 10, 11, 14, 16 to 19, 22, 23, 25; § 15(3) Dispute settlement body change report; Art. 4(14) first sentence; Art. 6(1), 6(2)(b), (h); Art. 11(1) second sentence, 11(2); enforceable Art. 14 order; Art. 23 second sentence; Art. 30(2) first sentence; Art. 30(3); Art. 31(3)
EUR 50,000 § 15(2) Nos. 3, 4, 5, 15, 20, 21, 24, 26, 27 Art. 4(5), 5(4); Art. 4(7), 5(10) notification; Art. 4(8), 5(11) second sentence; Art. 9(7); Art. 25(1) second sentence; Art. 26; Art. 30(5); Art. 37(11), (12) legal representative
No fine not listed Art. 3(2), (3); Art. 4(2) notification; Art. 13

Which Breaches Fall in Each German Tier

The EUR 500,000 tier covers the core access duties: data access by design (Art. 3(1)), making data available to the user and to third parties (Art. 4(1), 5(1)), the non-compete rule (Art. 4(10)), use under the data licence agreement (Art. 4(13), 5(6)) and the third-party prohibitions in Art. 6(2)(c) to (e), plus breaches of an enforceable Bundesnetzagentur order. Only the Article 5(3) gatekeeper offence sits above it.

The EUR 100,000 tier holds technical duties, such as the switching obstacle (Art. 23) and the open interface (Art. 30(2)); the EUR 50,000 tier holds procedural ones, such as switching information (Art. 26) and the legal representative. Other national fine levels are compared under Data Act penalties and fines.

Obligations Outside the German Fine Catalogue

Three Data Act duties carry no fine in Germany: the pre-contractual information in Art. 3(2) and (3), the Art. 4(2) notification after a safety refusal and the unfair-terms rules of Art. 13 are not listed in § 15 DADG. They still apply directly, and the Bundesnetzagentur can enforce them by order (§ 9).

Intent, Coercive Fines and Fining Authorities in Germany

Only intentional breaches are fined: § 15 provides for no negligence, as the government bill's reasoning confirms with reference to § 10 OWiG (Administrative Offences Act).

The Bundesnetzagentur is the fining authority (§ 15(7)), and the BfDI fines personal-data breaches under Article 40(4) (§ 16). A Zwangsgeld (coercive fine) of up to EUR 500,000 enforces orders (§ 9(6)); it compels compliance and does not punish the breach itself.

Complaints, Notifications and Dispute Settlement in Germany

Anyone whose habitual residence, place of work or establishment is in Germany can complain to the Bundesnetzagentur about an infringement of their Data Act rights (Article 38(1)), and every complaint, notification and application goes through its web forms, never by e-mail.

The Bundesnetzagentur Complaint Portal and Its Four Forms

The Beschwerdeportal (complaint portal) offers four forms: data access, use and sharing under Chapters II to IV, public-sector requests under Chapter V, switching under Chapter VI, and the information duty on third-country access. According to the Bundesnetzagentur's complaint portal page, the complainant's view of being infringed suffices; no objective infringement is needed.

The address DataAct@BNetzA.de takes questions, not submissions. Where three or more complaints raise the same question, the Bundesnetzagentur may decide test cases first and suspend the rest, or merge them (§ 9(5) DADG).

Handbrake Notifications to the Bundesnetzagentur

Data holders with their main establishment in Germany notify the Bundesnetzagentur when they refuse or suspend sharing under Art. 4(2), 4(7), 4(8), 5(10) or 5(11), through Form02 (security), Form03 (trade secrets) or Form10 (follow-up).

On the Bundesnetzagentur's notification duties page, Form03 asks for the measure, product, data categories, affected party, reason and justification, whether a written decision was sent, and contact data. A refusal under the trade secrets handbrake is allowed only in exceptional cases where serious economic damage is highly likely (Art. 4(8), 5(11), recital 31).

Investigation Powers and Orders in Germany

Under § 6 DADG, §§ 7 to 14 apply to Article 38 complaints and to ex officio proceedings: the Bundesnetzagentur may investigate with the evidence rules of the ZPO (Code of Civil Procedure) and require information and documents (§§ 7, 8).

Enforcement runs from a request to remedy to orders or a finding of a past infringement (§ 9), with provisional orders until the final decision (§ 11). Submitters mark trade secrets and file a redacted version (§ 10). The authority publishes recommendations and may publish decisions (§ 13). Its decisions are open to the Verwaltungsrechtsweg (administrative courts).

Certification of Dispute Settlement Bodies in Germany

The Bundesnetzagentur certifies dispute settlement bodies under Art. 10(5) on reasoned application, keeps the register, informs the Commission and charges a fee (§ 5 DADG).

Its certification guide is published in German and English, and certified bodies report the start and end of each procedure to the Bundesnetzagentur and the BfDI (§ 5(7)). As of 5 November 2026, its dispute settlement page lists no approved body yet. The Article 10 procedure is explained under dispute settlement bodies.

Steps by role are set out in the Data Act compliance checklist.

Bundesnetzagentur and BfDI Guidance for Companies in Germany

As of 5 November 2026, the Bundesnetzagentur publishes five Data Act factsheets, its forms and pages on notification duties and dispute settlement, and the BfDI has issued two guidelines under the DADG, both version 1.0 of 12 October 2026. None of this guidance is binding law.

The BfDI guidelines are internal guidance for the Bundesnetzagentur under § 3(2) DADG, not rules for companies: 1/2026 helps it decide whether the BfDI must take part in a Chapter II case, and 2/2026 names four case groups in which that participation follows a simplified procedure, starting with access cases where the user is the data subject. Unclear cases follow the full procedure. The Bundesnetzagentur's DATA ImpACT online sessions began on 15 July 2026; a Chapter V session is scheduled for 10 November 2026.

The guidance sources are:

  • Factsheets 1 to 5: at a glance, data access and use, public bodies, switching, and "Interoperatibilität" (as published).
  • BfDI guidelines: 1/2026 "Personenbezug" (personal reference) and 2/2026 "Vereinfachtes Verfahren" (simplified procedure).
  • Complaint portal: four forms.
  • Notification duties page: Form02, Form03, Form10.
  • Interoperability page: names DIN NA 043-01-38AA, CEN/CLC/JTC 25 and ETSI TC DATA.
  • Commission documents: the official Data Act guidance.

German Specifics: Database Right, Public-Body Requests and Foreign Parties

The law of 26 May 2026 adds § 87b(3) to the Urheberrechtsgesetz (Copyright Act), so the German database right does not apply in the cases named in Article 43 of the Data Act. The EU rule it mirrors is explained under Database Directive (Article 43).

The Bundesnetzagentur examines Chapter V requests of federal public bodies, and authorities under Land law examine those of Länder bodies (§ 2(2) No. 8 DADG), a split that follows a Bundesrat request.

Foreign parties receive decisions through an authorised person in Germany or another EU state, otherwise by Amtsblatt publication or service abroad (§ 12(1)). Non-EU entities designate a legal representative (Art. 37(11)); until then all Member States are competent (Art. 37(13)).

Germany in the EU-Wide Comparison

As of 5 November 2026, Germany's DADG is one row in the EU-wide comparison of competent authorities, data coordinators and penalty laws. The other rows are under Data Act implementation by country.

EU dates bind German companies without a German act, such as access by design for products placed on the market after 12 September 2026.

Seven related pages cover two other Member States and the EU rules behind the German procedures.

Pending Changes Affecting the German Rules

As of 5 November 2026, no DADG amendment has been found, and the Digital Omnibus proposal COM(2025) 837 of 19 November 2025 is pending, with a Council mandate agreed by Coreper on 21 October 2026 and the European Parliament at committee stage. The Commission proposal would replace Article 38, the complaint right behind the Bundesnetzagentur portal, and would not amend Article 37, the basis of § 2 DADG; its status is tracked under Data Act amendments.

Questions about the Data Act in Germany

Four questions are answered below.

What is the official name of the German Data Act law?

It is the Gesetz zur Anwendung und Durchsetzung der Datenverordnung, short title Datenverordnung-Anwendungs-und-Durchsetzungs-Gesetz, abbreviation DADG: Article 1 of the law of 26 May 2026, BGBl. 2026 I Nr. 157.

Has the Bundesnetzagentur imposed a Data Act fine yet?

No fine or decision under the DADG was found as of 5 November 2026; § 15 DADG fines only intentional breaches.

Who supervises personal data at German public bodies?

As of 5 November 2026, the BfDI supervises federal public bodies, and the Länder data protection authorities supervise Länder public bodies.

Where do data holders based in another Member State notify?

According to the Bundesnetzagentur's notification duties page (as of 5 November 2026), they notify the data coordinator of the Member State of their main establishment, not the Bundesnetzagentur.

Sources