Technology, Data & Cyber in Germany

Full guide · Source-checked research99% of statements checked against a source109 checked against an official source1 checked against a secondary sourceChecked 2026-10-18Not yet professionally reviewed

• For supplies between businesses that are both established in Germany, the invoice must be an electronic invoice issued, transmitted and received in a structured format that complies with the European e-invoicing standard under Directive 2014/55/EU.

  Domestic B2B supplies; subject to the transitional rules in de-tax-009. Paper and unstructured electronic invoices are 'other invoices'.Bundesministerium der Justiz / Bundesamt für Justiz (gesetze-im-internet.de) · checked 2026-10-18

• Paper or other non-structured invoices remain permitted for domestic B2B supplies made in 2025 and 2026; for supplies made in 2027 they are permitted only if the issuer's total turnover in the previous calendar year did not exceed EUR 800,000, or if the invoice is sent by EDI.

  Transitional rules for issuing invoices; non-paper other formats need the recipient's consent. No transition applies after 2027.Bundesministerium der Justiz / Bundesamt für Justiz (gesetze-im-internet.de) · checked 2026-10-18

• All businesses must be able to receive e-invoices for domestic B2B supplies from 1 January 2025 with no transitional period, while invoices up to EUR 250 and travel tickets are exempt from the e-invoice obligation.

  Administrative guidance; accepted formats include those compliant with EN 16931 such as XRechnung and ZUGFeRD from version 2.0.1 (excluding the MINIMUM and BASIC-WL profiles). An ordinary e-mail inbox is sufficient for receipt.Bundesministerium der Finanzen (published via Landesamt für Steuern Niedersachsen) · checked 2026-10-18

• Most private-sector businesses in Germany are supervised for data protection by the data protection authority of the federal state (Land) in which they are based, not by the Federal Commissioner (BfDI).

  Private companies, associations and freelancers. Broadcasting, press and church bodies have their own supervisory authorities.Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) · checked 2026-10-18

• The BfDI supervises federal public bodies and, for the personal data they process to provide those services, telecommunications and postal service providers.

  Telecoms and postal providers only for service-related processing; other activities such as employee data or address trading fall to the state authority.Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) · checked 2026-10-18

• The Datenschutzkonferenz lists 17 state data protection supervisory authorities for the 16 federal states, because Bavaria has a separate authority for the private sector (Bayerisches Landesamt für Datenschutzaufsicht).

  Bavaria: separate authorities for the public and private sectors; other states: one authority each.Datenschutzkonferenz (DSK) · checked 2026-10-18

• Under the Federal Data Protection Act (BDSG), controllers and processors must appoint a data protection officer if they generally employ at least 20 people who are constantly engaged in automated processing of personal data, in addition to the GDPR Article 37 cases.

  Regardless of headcount, a data protection officer is also required where processing needs a data protection impact assessment (Art. 35 GDPR) or personal data is processed commercially for transfer, anonymised transfer or market or opinion research.Bundesministerium der Justiz und für Verbraucherschutz / Bundesamt für Justiz (gesetze-im-internet.de) · checked 2026-10-18

• Storing information on, or reading information from, a user's device (for example through cookies) requires the user's consent based on clear and comprehensive information, under § 25 of the Telecommunications Digital Services Data Protection Act (TDDDG).

  No consent needed where the sole purpose is transmitting a message over a public telecoms network, or where access is strictly necessary to provide a digital service the user expressly requested (§ 25(2)).Bundesministerium der Justiz und für Verbraucherschutz / Bundesamt für Justiz (gesetze-im-internet.de) · checked 2026-10-18

Read the full guide: Tax, accounting and statutory reporting · Data protection, cyber security and e-invoicing