As of:
Translated from German. In case of discrepancies, the German version applies.
Glossary Law and data protection
Rules website owners should know – mostly German and EU law. General information, not legal advice.
Matching task: Hosting checklist · All topics in the glossary
Terms
- Barrierefreiheitsstärkungsgesetz (BFSG)
Also: BFSG
German act on strengthening accessibility (no official English version) that sets accessibility requirements for certain products and services, including e-commerce services for consumers provided after 28 June 2025. Whether and with which exceptions it applies to a website must be checked case by case.1
Related: Accessibility (WCAG)
- Consent
Also: opt-in, UWG § 7
Voluntary, informed and unambiguous agreement by a person, for example to promotional emails (Section 7 UWG, German law) or to storing information on their device (Section 25 TDDDG, German law). Anyone who relies on consent must be able to prove it.2,3,4
Related: Double opt-in, Cookie consent, GDPR
- Cookie consent
Also: cookie banner, consent banner, TDDDG § 25, TTDSG (former name of the act)
Request for consent before information is stored on or read from the user's device. Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG, formerly TTDSG) requires it, unless access is strictly necessary for a service explicitly requested. Applies not only to cookies but also to comparable techniques.3
Related: Consent, Web analytics, Cookie
- Data processing agreement (DPA)
Also: DPA, AV-Vertrag (German), AVV (German)
Agreement with a service provider that processes personal data on your behalf – such as a host on whose servers form submissions or customer accounts are stored. Required by Art. 28 GDPR.4
Related: GDPR, Technical and organisational measures (TOMs) · More on this
- GDPR
Also: General Data Protection Regulation, DSGVO (German)
EU Regulation 2016/679, which governs when and how personal data may be processed. Important for website owners are, among other things, legal bases, information obligations, processing on behalf (Art. 28) and security of processing (Art. 32).4
Related: Data processing agreement (DPA), Technical and organisational measures (TOMs), Transfer to third countries, Consent · More on this
- Impressum (legal notice)
Also: provider identification
Mandatory information about the provider of a commercial digital service under German law, such as name, address and email address, easily recognisable and permanently available. Governed by Section 5 of the Digitale-Dienste-Gesetz (DDG, the German act on digital services).5
Related: GDPR
- Technical and organisational measures (TOMs)
Also: TOM, TOMs
Precautions that protect personal data, such as encryption, access rights, backups and emergency plans. Art. 32 GDPR requires a level of protection appropriate to the risk; hosts usually describe their TOMs in an annex to the data processing agreement.4
Related: Data processing agreement (DPA), GDPR, Backup · More on this
- Transfer to third countries
Also: third-country transfer
Transfer of personal data to countries outside the European Economic Area, for example to a service provider's servers in the USA. Only permitted under the conditions of Art. 44 et seq. GDPR.4
Related: GDPR · More on this