← Data protection and cybercrime laws by country, compared
Germany: data protection law, cybercrimes, fines and penalties
Applies the GDPR, with the BfDI as federal authority; computer crimes defined in the StGB.
- Law
- GDPR + StGB (computer crimes)
- Authority
- BfDI (federal authority)
- Max fine
- €20M or 4% (GDPR); e.g. Vodafone €45M (2025)
- Breach notification
- 72h (GDPR)
- DPO
- Mandatory in GDPR art. 37 cases
Crimes
| Data espionage | §202a StGB | Up to 3 years |
| Computer fraud | §263a StGB | Up to 5 years |
| Computer sabotage | §303b StGB | Up to 3 years; up to 10 in serious cases |
| Extortion | §253 StGB | Up to 5 years |
Risks
- Security failures (Vodafone fined €45M, 2025)
- Management liability under NIS2
Source: gesetze-im-internet.de – StGB · GDPR Local – maiores multas