GDPR (DSGVO)

The General Data Protection Regulation (GDPR, German: DSGVO) governs the protection of personal data throughout the EU – in force since May 2018.

Your rights as a citizen:

• Right of access: every company must tell you what data it holds about you
• Right to erasure: you can demand that your data be deleted ("right to be forgotten")
• Right to data portability: you can take your data with you to another provider
• Right to object: you can object to the processing of your data

What companies must observe:

• Consent: data may only be processed with your consent
• Data protection officer: mandatory in Germany from 20 employees who regularly process data
• Data breaches: must be reported to the authority within 72 hours

Fines:

• Up to 20 million euros or 4% of global annual turnover (whichever is higher)
• Highest fine: 1.2 billion euros against Meta (2023, Ireland)
• Germany: H&M 35.3 million, Deutsche Wohnen 14.5 million

In finance:

• Banks must explain what they use your data for
• Schufa must give you information free of charge (once a year via meineschufa.de)
• Advertising calls without consent are illegal