Notification

The data protection law valid before the General Data Protection Regulation (GDPR) included a system for notification. Data controllers reported the structure (not the actual content) of their data applications to the Data Processing Register (Datenverarbeitungsregister).

The General Data Protection Regulation abolishes this system and replaces it with the records of processing activities (Art. 30 GDPR) and data protection impact assessments (Art. 35 and 36 GDPR).

The obligation to notify ends with 25 May 2018. The Data Processing Register no longer accepts notifications from this day on, but remains available for consultation (in German language): DVR Online.

The data controllers who submitted the notifications (called “Auftraggeber” under the old legal rules) can log on and download all the documents and correspondence that accompanied the notification. Refer to our German website for Information.

The list of processing operations for which no data protection impact assessment is required (Art. 35 para. 5 GDPR) will take prior compliance through the notification system into account.