Employee data protection (Beschäftigtendatenschutz) governs how employers handle staff personal data under the DSGVO and BDSG, from application to termination. The central national provision was § 26 BDSG, whose standing as a self-contained legal basis has been uncertain since the ECJ ruling of 30 March 2023 (C-34/21). A dedicated Beschäftigtendatengesetz has been drafted but was not yet in force as of August 2026.
At a glance
- Legal framework: the DSGVO as overriding EU law, supplemented by national rules in the BDSG
- § 26 BDSG was the core provision for the employment relationship, but after the ECJ ruling it is only of limited use as a self-contained legal basis
- Principles: lawfulness, necessity, purpose limitation, data minimisation and transparency
- Data subject rights, in particular access, rectification, erasure and objection
- Works council co-determination for technical systems capable of monitoring conduct or performance (§ 87 BetrVG)
- Erasure once the purpose no longer applies; retention only where statutory duties require it
Legal situation in flux
- The ECJ held that § 26 BDSG contains no specific safeguards beyond the DSGVO and therefore does not suffice as a standalone legal basis; processing must be measured directly against the DSGVO
- A dedicated Beschäftigtendatengesetz (BeschDG) was put forward as a ministerial draft (October 2024) but had not entered into force as of August 2026
- Conservative practice: secure every processing activity twice, via a sound DSGVO legal basis and, where relevant, § 26 BDSG
FAQ
On what legal basis may employee data be processed?
Primarily on the basis of the DSGVO, in particular where processing is necessary to perform the employment relationship. § 26 BDSG may be used in support but, after the ECJ ruling, should not serve as the sole basis.
What does the ECJ ruling C-34/21 mean in practice?
The ECJ considers § 26 BDSG problematic under EU law because it adds no safeguards beyond the DSGVO. Employers should align processing directly with DSGVO requirements and document it carefully.
Do employees have a right to access their data?
Yes. Under the DSGVO they can request information about the data processed, the purposes, recipients and storage period, and obtain a copy.
When must the works council be involved?
Where technical systems suitable for monitoring employees' conduct or performance are introduced or used, there is a co-determination right under § 87 BetrVG.
Last updated: August 2026
This article provides general information and is not a substitute for legal advice in individual cases.
Jonas Stoffel
